The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
3answers
34 views

How to see traffic traversing a Cisco ASA by inside host?

I have a Cisco ASA 5515 running 9.1 and am interested in learning how I can see bandwidth usage by individual hosts. For instance, using MRTG I can see that my average bandwidth utilization is approx ...
0
votes
0answers
15 views

What is the Cisco 7200 VXR Netflow Default Sample Rate?

I am trying to collect netflow data from a Cisco 7200 VXR router. I need to specify the sample rate, but I cannot seem to get the information from the cisco router and I do not know what the default ...
0
votes
0answers
6 views

In WUG, what is the best approach to “Alert” on missing top conversations?

I want to alert on abnormal traffic, specifically: Constant traffic that drops over a certain threshold (Specifically Recoverpoint, SRM, or Exchange logs) Intelligent analytics: (I should see 5GB of ...
0
votes
0answers
50 views

wireshark not showing netflow source addresses nfdump does

Hi guys i'm experiencing following issue, hope someone can explain me what's happening. I got a pcap with a dump of udp packets containing netflow data. I've used tcprewrite and tcpreplay to ...
0
votes
1answer
85 views

CA Network Flow Analysis - sFlow Monitoring Issues

I've been attempting to monitor sFlow traffic from some F5 LTMs, but I'm getting figures like 9 terabytes of data over http, which I don't believe we are getting. Has anyone else had issues like this ...
0
votes
1answer
128 views

Does CA Network Flow Analysis Monitor SFlow

Does anyone know if CA Network Flow Analysis can monitor SFlow or receive SFlow packets ?
1
vote
3answers
78 views

Syslog to IPFIX

I was reading about logs (syslog) being exported in IPFIX format. And some products which do this as well. What I didn't find, was if there is any standard/known ways of doing this ?. Like if there ...
-1
votes
2answers
463 views

Is ntop's sflow support equivalent to netflow?

I've seen conflicting information from various dates and I'm having trouble determining if ntop supports sflow the same way it supports netflow or if it is somehow handicapped and not really worth ...
0
votes
1answer
162 views

Memory leak in flow_fanout flow_capture. And strange ip in flow_capture output

On my freebsd box: #uname -rimp 9.1-STABLE amd64 amd64 GENERIC flow_tools: > pkg_info -x flow Information for flow-tools-0.68_7: Comment: Suite of tools and library to work with netflow data ...
2
votes
1answer
52 views

What is the difference between flow-cat and flow-merge?

I am trying to create some monitoring based on flow-tools: I have flow-capture running to log things into directories. Now I need to merge files together for my analysation interval. I have looked at ...
0
votes
3answers
262 views

Netflow/IPfix Analyzer for network threats and anomalies

I'm evaluating various options for Netflow/IPfix based analyzers which focus on identifying security threats and anomalies. It would be highly appreciated if someone can provide a list of tools with ...
1
vote
1answer
546 views

Netflow to syslog converter

Is there any way to have netflow v9 converted to syslog? Which would be the best way to have the following idea working? Procedure: 1) The router sends UDP with the following structure: ...
3
votes
0answers
199 views

How to support VRF in Netflow Collector?

I am somehow able to analyze netflow packet using my own netflow collector (build in python). It works for certain ip and CIDR(Classless Inter Domain routing), definitely not overlapping. What is the ...
1
vote
1answer
308 views

NetFlow Storage Calculator

I am planning to deploy a NetFlow server (using NfSen/NfDump) for harvesting data from Cisco devices; Are there standard calculations or guidelines I can use to calculate my server requirements, ...
1
vote
1answer
1k views

How come the netflow data isn't showing up on the server?

I have a mikrotik router and it is sending trafficflow (fully compatible with netflow) data to my debian server that is running cacti. But after installing cacti's flowviewer plugin, cacti doesnt ...
2
votes
1answer
912 views

ntop to analyse bandwidth usage on multiple ASA 5505

I have set up a netflow server at our data centre, which is connected via VPN to ~40 remote offices using Cisco ASA 5505. The aim is to analyse usage data and find out exactly how the remote ...
0
votes
2answers
825 views

iptables+iptables_netflow: iptables blocking netflow export?

I am running an iptables firewall on OpenSuSE 11.3 --recently I became interested in traffic monitoring and accounting, and to this end installed iptables_netflow module on the firewall and WANGuard ...
10
votes
2answers
8k views

How to generate netflow data in linux

We have a number of Linux servers for which I would like to capture netflow data to be processed by a netflow analyzer. I've been spoiled by the ease in which Mikrotik routers allow netflow data ...
2
votes
1answer
248 views

How useful is the sysUptime value in a Netflow packet?

The value is in theory precise down to the millisecond, but I am skeptical. Does that number tell when the packet was transmitted, or when the connection began or ended? Subsequently I noticed ...
0
votes
3answers
333 views

Netflow packet includes zero port numbers?

What does a zero source port number indicate? Can Netflow tell about something a connection that is not TCP or UDP? Thanks.
2
votes
2answers
671 views

Problems with getting both ingress and egress Netflow data

I have a Cisco 6500 switch that I want to capture all vlan8 traffic incoming and outgoing. I talked with my networking group and they set me up with the following commands. (May not be exact commands ...
1
vote
3answers
373 views

Have NetFlow show true destinations

Currently NetFlow is showing destination (of inbound traffic) as our outside IP rather than inside IP. Also, for all outbound traffic, it is showing the source as our firewall rather than ...
3
votes
6answers
2k views

Generating and capturing Netflow on a Linux router

We currently have a dual-NIC Ubuntu server at our data centre acting as the gateway router between our public networks and our ISP. We have a /30 cross connect network on the ISP-facing NIC, and one ...