The tag has no usage guidance.

learn more… | top users | synonyms

1
vote
1answer
25 views

What is correct iptables chain to put -j NETFLOW

I have a router, with firewall (with drop policy), nats, services. I want to account all factual traffic (inputed before firewal, outputed by services, and passed firewall in forwarding), with its "...
2
votes
2answers
1k views

Problems with getting both ingress and egress Netflow data

I have a Cisco 6500 switch that I want to capture all vlan8 traffic incoming and outgoing. I talked with my networking group and they set me up with the following commands. (May not be exact commands ...
0
votes
0answers
52 views

Issue with nfsen in fetching sflow data from Linux host

I have two VMs. The first VM is at AWS EC2 instance (red hat). I am using this system as sflow agent. I have installed hsflowd in this machine. My hsflowd.conf file looks like following: DNSSD = ...
0
votes
0answers
116 views

Best way to collect Netflow Accounting to store in Elasticsearch

currently i'm trying to figure out the best and most efficient way to collect NetFlow Accounting data. I decided to use Elasticsearch for indexing and Kibana (or maybe QBana) for data analysis. I ...
0
votes
0answers
69 views

How to configure netflow on linux bridges(“docker0” Bridge)

I have Openstack setup which one of the compute node has docker and if I want to monitor the traffic, how to configure netflow on "docker0" bridge/Linux Bridge. I can see the bridge name and ID with ...
14
votes
6answers
7k views

Solution to route/proxy SNMP Traps (or Netflow, generic UDP, etc) for network monitoring?

I'm implementing a network monitoring solution for a very large network (approximately 5000 network devices). We'd like to have all devices on our network send SNMP traps to a single box (technically ...
1
vote
1answer
241 views

MikroTik - Traffic flow (Netflow) Octets Counter wrap

I am using Traffic Flow with pmacct (nfacct) to do IP Accounting. I've noticed that if a flow exceeds ~4GBytes in less than a minute (which is my active-flow-timeout) the exported flow Octets counter ...
1
vote
1answer
41 views

source MAC and destination Mac in netflow( or Sflow)

Is any way to see source MAC and destination MAC in netflow(or Sflow) data, like nfdump -r <FILE_NAME> for netflow data. Any best open source(or free) collector for Sflow?
1
vote
1answer
96 views

How to configure aws in order to get log events?

My question has two parts: - How to get log events? The command line tells me that I need to configure aws... - How to configure aws? I try to get log events by doing the following: sudo aws logs ...
4
votes
4answers
7k views

Netflow Collector for Windows Free

Is there a free netflow collector that I can throw on a windows box?
6
votes
5answers
31k views

Monitoring Bandwidth Usage (Per Internal IP) - Cisco ASA 5505

I manage a small network with a Cisco ASA 5505 and a shared DSL connection. I would like to be able monitor the bandwidth usage of the various users/devices on my network (by IP address). Can I do ...
2
votes
2answers
2k views

On Mikrotik RouterOS, is it possible to get Netflow information from a bridged connection?

I have a RouterOS box set up to bridge two ethernet connections. I have use-ip-firewall=yes in the bridge configuration, so that the ports go through the firewall. I've enabled netflow reporting via ...
4
votes
3answers
9k views

Can I use Cisco ASA's “NetFlow Security Event Logging” (NetFlow 9) for bandwidth monitoring

Cisco has introduced NetFlow 9 export in the latest software version for ASA firewalls. But it seems to be meant for event logging of security events only (as a replacement for syslog messages). But ...
2
votes
1answer
1k views

On RouterOS, how will transparent proxying (with DNAT) affect reporting of netflow?

I have a box running Mikrotik RouterOS, which is set up to do transparent web proxying, as described here. In short, this means that I have a firewall rule for destination NAT causing any port 80 ...
1
vote
1answer
2k views

How come the netflow data isn't showing up on the server?

I have a mikrotik router and it is sending trafficflow (fully compatible with netflow) data to my debian server that is running cacti. But after installing cacti's flowviewer plugin, cacti doesnt ...
1
vote
5answers
411 views

Netflow use cases? [closed]

My company stores netflow mainly for accidents` investigation. What other interesting use cases, tools for insight to your network or applications using netflow you know?
2
votes
1answer
421 views

How useful is the sysUptime value in a Netflow packet?

The value is in theory precise down to the millisecond, but I am skeptical. Does that number tell when the packet was transmitted, or when the connection began or ended? Note: Subsequently I ...
2
votes
4answers
747 views

Can someone explain what NETFLOW. and IPFLOW are?

I hear these terms used a lot but haven't found a decent explanation of what they are, how they are used, and what the data looks like (e.g. can you view this data in wireshark?)?
1
vote
1answer
622 views

Implementing Argus (similar to netflow) what kind of information should I be gathering?

I am setting up a trial of Argus at my company as a diagnostic tool. We have a collector box attached to a monitoring port on our switch, and the initial plan is to redirect ports with unusual traffic ...
0
votes
1answer
1k views

How do I configure NetFlow 5/9 export on Juniper switches? [closed]

What are the commands to make a Juniper switch send netflow data (V5 or V9) to a netflow collector for bandwidth monitoring?
2
votes
1answer
4k views

NTOP vs NFSEN, which one? [closed]

I want to monitor Cisco's newflows. Which one of these tools do you recommend?
0
votes
1answer
148 views

Creating High Availability Netflow Collector

I'm currently working on replacing our existing Netflow collector that is EOL with a new one. The goal is to support around 4 million flows/minute and have HA capabilities. Below is my initial thought:...
1
vote
1answer
416 views

Installing Samplicator on CentOS

I'm trying to install Samplicator to test Netflow central collector and then forwarding to other collectors from there. I mainly want to use Samplicator due to it being able to easily sample the ...
2
votes
2answers
1k views

iptables+iptables_netflow: iptables blocking netflow export?

I am running an iptables firewall on OpenSuSE 11.3 --recently I became interested in traffic monitoring and accounting, and to this end installed iptables_netflow module on the firewall and WANGuard ...
0
votes
3answers
350 views

How to see traffic traversing a Cisco ASA by inside host?

I have a Cisco ASA 5515 running 9.1 and am interested in learning how I can see bandwidth usage by individual hosts. For instance, using MRTG I can see that my average bandwidth utilization is approx ...
0
votes
0answers
64 views

What is the Cisco 7200 VXR Netflow Default Sample Rate?

I am trying to collect netflow data from a Cisco 7200 VXR router. I need to specify the sample rate, but I cannot seem to get the information from the cisco router and I do not know what the default ...
2
votes
3answers
160 views

Syslog to IPFIX

I was reading about logs (syslog) being exported in IPFIX format. And some products which do this as well. What I didn't find, was if there is any standard/known ways of doing this ?. Like if there ...
0
votes
1answer
132 views

CA Network Flow Analysis - sFlow Monitoring Issues

I've been attempting to monitor sFlow traffic from some F5 LTMs, but I'm getting figures like 9 terabytes of data over http, which I don't believe we are getting. Has anyone else had issues like this ...
3
votes
6answers
3k views

Generating and capturing Netflow on a Linux router

We currently have a dual-NIC Ubuntu server at our data centre acting as the gateway router between our public networks and our ISP. We have a /30 cross connect network on the ISP-facing NIC, and one ...
2
votes
1answer
104 views

What is the difference between flow-cat and flow-merge?

I am trying to create some monitoring based on flow-tools: I have flow-capture running to log things into directories. Now I need to merge files together for my analysation interval. I have looked at ...
0
votes
1answer
259 views

Does CA Network Flow Analysis Monitor SFlow

Does anyone know if CA Network Flow Analysis can monitor SFlow or receive SFlow packets ?
-1
votes
2answers
648 views

Is ntop's sflow support equivalent to netflow?

I've seen conflicting information from various dates and I'm having trouble determining if ntop supports sflow the same way it supports netflow or if it is somehow handicapped and not really worth ...
0
votes
1answer
216 views

Memory leak in flow_fanout flow_capture. And strange ip in flow_capture output

On my freebsd box: #uname -rimp 9.1-STABLE amd64 amd64 GENERIC flow_tools: > pkg_info -x flow Information for flow-tools-0.68_7: Comment: Suite of tools and library to work with netflow data ...
0
votes
3answers
734 views

Netflow packet includes zero port numbers?

What does a zero source port number indicate? Can Netflow tell about something a connection that is not TCP or UDP? Thanks.
1
vote
1answer
1k views

Netflow to syslog converter

Is there any way to have netflow v9 converted to syslog? Which would be the best way to have the following idea working? Procedure: 1) The router sends UDP with the following structure: templateId=...
1
vote
3answers
567 views

Netflow/IPfix Analyzer for network threats and anomalies

I'm evaluating various options for Netflow/IPfix based analyzers which focus on identifying security threats and anomalies. It would be highly appreciated if someone can provide a list of tools with ...
4
votes
0answers
402 views

How to support VRF in Netflow Collector?

I am somehow able to analyze netflow packet using my own netflow collector (build in python). It works for certain ip and CIDR(Classless Inter Domain routing), definitely not overlapping. What is the ...
1
vote
1answer
518 views

NetFlow Storage Calculator

I am planning to deploy a NetFlow server (using NfSen/NfDump) for harvesting data from Cisco devices; Are there standard calculations or guidelines I can use to calculate my server requirements, ...
2
votes
1answer
1k views

ntop to analyse bandwidth usage on multiple ASA 5505

I have set up a netflow server at our data centre, which is connected via VPN to ~40 remote offices using Cisco ASA 5505. The aim is to analyse usage data and find out exactly how the remote ...
12
votes
2answers
17k views

How to generate netflow data in linux

We have a number of Linux servers for which I would like to capture netflow data to be processed by a netflow analyzer. I've been spoiled by the ease in which Mikrotik routers allow netflow data ...
1
vote
3answers
620 views

Have NetFlow show true destinations

Currently NetFlow is showing destination (of inbound traffic) as our outside IP rather than inside IP. Also, for all outbound traffic, it is showing the source as our firewall rather than ...