<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:a="urn:schemas-microsoft-com:office:access" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#RowsetSchema" xmlns:b="urn:schemas-microsoft-com:office:publisher" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:c="urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:odc="urn:schemas-microsoft-com:office:odc" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:q="http://schemas.xmlsoap.org/soap/envelope/" xmlns:rtc="http://microsoft.com/officenet/conferencing" xmlns:D="DAV:" xmlns:Repl="http://schemas.microsoft.com/repl/" xmlns:mt="http://schemas.microsoft.com/sharepoint/soap/meetings/" xmlns:x2="http://schemas.microsoft.com/office/excel/2003/xml" xmlns:ppda="http://www.passport.com/NameSpace.xsd" xmlns:ois="http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:dsp="http://schemas.microsoft.com/sharepoint/dsp" xmlns:udc="http://schemas.microsoft.com/data/udc" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:sub="http://schemas.microsoft.com/sharepoint/soap/2002/1/alerts/" xmlns:ec="http://www.w3.org/2001/04/xmlenc#" xmlns:sp="http://schemas.microsoft.com/sharepoint/" xmlns:sps="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:udcs="http://schemas.microsoft.com/data/udc/soap" xmlns:udcxf="http://schemas.microsoft.com/data/udc/xmlfile" xmlns:udcp2p="http://schemas.microsoft.com/data/udc/parttopart" xmlns:wf="http://schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:dsss="http://schemas.microsoft.com/office/2006/digsig-setup" xmlns:dssi="http://schemas.microsoft.com/office/2006/digsig" xmlns:mdssi="http://schemas.openxmlformats.org/package/2006/digital-signature" xmlns:mver="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mrels="http://schemas.openxmlformats.org/package/2006/relationships" xmlns:spwp="http://microsoft.com/sharepoint/webpartpages" xmlns:ex12t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:ex12m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:pptsl="http://schemas.microsoft.com/sharepoint/soap/SlideLibrary/" xmlns:spsl="http://microsoft.com/webservices/SharePointPortalServer/PublishedLinksService" xmlns:Z="urn:schemas-microsoft-com:" xmlns:st="" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-AU link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>Hi Shaun,<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>I Have used Manage Engine before, both free and paid and am not too impressed with the speed of it, it’s just too sluggish and is based on JAVA too.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>It eventually comes up with some nice flows but I need something a little more robust that wont go into a 45 minute death spiral when a dataset gets too large.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>PMACCT is awesome for sniffing and generating / aggregating / exporting flows.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>I have been looking at PMACCT recently and it looks like it can export netflow V9 which categorises IPv6 traffic and MPLS Traffic as well as boring old IPv4.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Being able to use it as the reflector to tag AS’s into the path information is kind of vital for a third party collector, and so far is the only flow-sniffer/generator / exporter that isn’t based on the equipment where the flows are traversing to generate the flow info.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Step 1 in a Ghetto Flow exporter in my mind is Definitely PMACCT, but then where to export the info to, and how to visualise it is the next hard part.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>I have the choice to code something myself for the flows, but then I realised I’d rather be fishing, so am looking to rig something up as the viewer side of things.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Command line is great and all but I’m getting older and smarter(lazier) and realise that looking at fast moving and self updating graphs is easier than frantically typing lots of stuff. (And looks great on a feature wall).<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>After a link from another punter off-list, I followed through wth some googling and came up with<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><a href="http://www.networkuptime.com/tools/netflow/index.html">http://www.networkuptime.com/tools/netflow/index.html</a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>As a few freeby tools. Not all are open source though.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Flowscan looks like it might do the trick, but might need some updating to display the RRD’s a little nicer.<o:p></o:p></p><p class=MsoNormal><a href="http://www.networkuptime.com/tools/netflow/flowscan.html">http://www.networkuptime.com/tools/netflow/flowscan.html</a><span style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>S.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Shaun Deans :: Kadeo [mailto:shaun@kadeo.com.au] <br><b>Sent:</b> Monday, 13 December 2010 2:09 PM<br><b>To:</b> Sean K. Finn; 'ausnog (ausnog@ausnog.net)'<br><b>Subject:</b> RE: Best Open-Source Flow analyzer tools<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Sean.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>I have been meaning to cook something up using <a href="http://www.pmacct.net/">pmacct</a> for a long time, but never seem to get there.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>This package exposes a [s/net]flow daemon which can aggregate flows via various metrics.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>It also has an option to create a BGP “Route Reflector” setup to work out BGP next hops etc.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>The only issue is that you get out of this what you put into it because its all based on custom configs and gui’s / queries.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>There are some frontends available.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>As for the professional tool you can’t go past the <a href="http://www.manageengine.com/products/netflow/index1.html">Manage Engine Netflow Analyser </a> they have a free version that allows you to graph to interfaces.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Its quite interesting to throw on an interface for a week and then watch the trends that develop.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Cheers<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Shaun <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> ausnog-bounces@lists.ausnog.net [mailto:ausnog-bounces@lists.ausnog.net] <b>On Behalf Of </b>Sean K. Finn<br><b>Sent:</b> Monday, 13 December 2010 1:42 PM<br><b>To:</b> 'ausnog (ausnog@ausnog.net)'<br><b>Subject:</b> [AusNOG] Best Open-Source Flow analyzer tools<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hi AusNOG.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I’m looking for recommendations on the best open-source gui based visualisation tools for Flows.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Currently I’m using a paid-for Solar-Winds Flow-viewer that hangs off a MySQL Database, but runs Java as the web server / portal software. I think the current revision is called <a href="http://www.solarwinds.com/products/orion/nta/">http://www.solarwinds.com/products/orion/nta/</a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>It keeps getting clunky, and I keep throwing more hardware at it, but JAVA is just a pig.<o:p></o:p></p><p class=MsoNormal>I’m looking for alternatives because I really hate running Java.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>My question to list is, what Open-Source alternatives are out there, and are there any good ones that people have used and can recommend?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I currently use the flow visualiser for dissection of network events after-the-fact, because its clunky and slow and takes a little while to sift through the information.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>For live events I have text-based tools that give 1 second resolution and instant feedback on whats happening *<b>now</b>*.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>If there are web based or gui tools out there that can run real-time, then great, but I’m really after something to show aggregate flows based on protocols by time of day, etc, all the nice stuff, basically to help traffic profile and dissect events to understand them better.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Any recommendations?<o:p></o:p></p><p class=MsoNormal>If there are better paid-for ones out there, lets hear it, too.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Sean.<o:p></o:p></p><p class=MsoNormal>(Feel free to reply on list and discuss / dissect).<o:p></o:p></p></div></body></html>