2

I have set up a netflow server at our data centre, which is connected via VPN to ~40 remote offices using Cisco ASA 5505. The aim is to analyse usage data and find out exactly how the remote connections are being used.

I followed through http://techowto.files.wordpress.com/2008/09/ntop-guide.pdf to set up ntop and https://supportforums.cisco.com/docs/DOC-6114 to set up the ASAs. I can see from the Plugin > Netflow > Statistics page that netflow packets from my ASAs are being received - the counter is increasing. However, I am not seeing any breakdown on the Global Traffic Statistic page after switching to the Netflow interface. I'm just seeing a pie chart showing 100% traffic for eth0.

The interfaces and documentation are a little hard to follow so I am not sure I have got things configured correctly.

When setting up my NetFlow-device.2 I can specify Virtual NetFlow Interface Network Address - the web UI says

This value is in the form of a network address and mask on the network where the actual NetFlow probe is located.

  • is this a Network address (e.g. 192.168.0.0/24) or an actual host IP address (192.167.0.1/24)?
  • If that should be a network address, is this the network in which one of my ASAs is or the network in which my ntop server is?
  • If a host IP address, is this the IP address used by eth0 on my ntop server, the IP address of an ASA, or something else?
  • Do I need a separate virtual interface for each ASA I am collecting netflow data from?

Any guidance would be greatly welcome.

1 Answer 1

0

I was advised by the ntop community to update to the SVN version of ntop, and this did indeed start populating the graphs without configuring things differently.

However, I have found that after collecting data for a few weeks, I am not seeing useful results. I have read that there are certain limitations with the netflow data from ASAs which may result in this. I think for better analysis I am probably looking at a different collection mechanism for data, and the lack of current and clear documentation for NTOP means I am probably looking elsewhere for collating and interpreting the data too. Back to the drawing board!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .