<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-AU link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Sean.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>I have been meaning to cook something up using <a href="http://www.pmacct.net/">pmacct</a> for a long time, but never seem to get there.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>This package exposes a [s/net]flow daemon which can aggregate flows via various metrics.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>It also has an option to create a BGP “Route Reflector” setup to work out BGP next hops etc.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>The only issue is that you get out of this what you put into it because its all based on custom configs and gui’s / queries.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>There are some frontends available.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>As for the professional tool you can’t go past the <a href="http://www.manageengine.com/products/netflow/index1.html">Manage Engine Netflow Analyser </a> they have a free version that allows you to graph to interfaces.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Its quite interesting to throw on an interface for a week and then watch the trends that develop.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Cheers<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Shaun <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> ausnog-bounces@lists.ausnog.net [mailto:ausnog-bounces@lists.ausnog.net] <b>On Behalf Of </b>Sean K. Finn<br><b>Sent:</b> Monday, 13 December 2010 1:42 PM<br><b>To:</b> 'ausnog (ausnog@ausnog.net)'<br><b>Subject:</b> [AusNOG] Best Open-Source Flow analyzer tools<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hi AusNOG.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I’m looking for recommendations on the best open-source gui based visualisation tools for Flows.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Currently I’m using a paid-for Solar-Winds Flow-viewer that hangs off a MySQL Database, but runs Java as the web server / portal software. I think the current revision is called <a href="http://www.solarwinds.com/products/orion/nta/">http://www.solarwinds.com/products/orion/nta/</a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>It keeps getting clunky, and I keep throwing more hardware at it, but JAVA is just a pig.<o:p></o:p></p><p class=MsoNormal>I’m looking for alternatives because I really hate running Java.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>My question to list is, what Open-Source alternatives are out there, and are there any good ones that people have used and can recommend?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I currently use the flow visualiser for dissection of network events after-the-fact, because its clunky and slow and takes a little while to sift through the information.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>For live events I have text-based tools that give 1 second resolution and instant feedback on whats happening *<b>now</b>*.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>If there are web based or gui tools out there that can run real-time, then great, but I’m really after something to show aggregate flows based on protocols by time of day, etc, all the nice stuff, basically to help traffic profile and dissect events to understand them better.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Any recommendations?<o:p></o:p></p><p class=MsoNormal>If there are better paid-for ones out there, lets hear it, too.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Sean.<o:p></o:p></p><p class=MsoNormal>(Feel free to reply on list and discuss / dissect).<o:p></o:p></p></div></body></html>