Software Netflow probes, What do you use?

[AMD_Gamer]

I am interested in setting up some software based probes for Netflow. I read all about nProbe from the people that make ntop but they charge for it. I also have learned about fprobe and softflowd but the documentation and google hits are lacking so I am not sure if they work as good? What do you use for your Software based Netflow probes for switched networks?

 

[obrith]

I use softflowd on my pfsense boxes, I run it manually via cron on many interfaces at once on the main firewalls at work. It works great, sending all the data off to a collector VM that reports via FlowViewer.

 

[AMD_Gamer]

Does it have all the features and information?

 

[obrith]

It sends a standard NetFlow output... it's quite detailed if you know how to read it or have a program to do it for you.

 

[AMD_Gamer]

It sends a standard NetFlow output... it's quite detailed if you know how to read it or have a program to do it for you.

That's what I am saying. What is a standard output? does nProbe or not netflow probes send more information?

 

[obrith]

I doubt it's much different. NetFlow is most everything about each 'flow' except the actual data. NetFlow is just grabbing raw data though, you will still want other program(s) to interpret it.

 

[Protoform-X]

NetFlow Analyzer is really easy to get setup and monitoring. The free edition is limited to how many devices it can manage, but still pretty cool for learning NetFlow. Lots of trigger options and what-not.

http://www.manageengine.com/products/netflow/download-free.html

 

[AMD_Gamer]

NetFlow Analyzer is really easy to get setup and monitoring. The free edition is limited to how many devices it can manage, but still pretty cool for learning NetFlow. Lots of trigger options and what-not.

http://www.manageengine.com/products/netflow/download-free.html

That is just a collector. I am looking into Probes for switched networks.

 

[Protoform-X]

Sorry, have only used NetFlow on routers. I have no idea what your trying to accomplish, but gl.

 

[Vito_Corleone]

So what's the goal?

 

[SmithyJones]

That is just a collector. I am looking into Probes for switched networks.

I don't understand your statement here. Any netflow software is going to interface with a device and collect the data. What is it that you think the difference between a probe and a collector is?

 

[obrith]

I don't understand your statement here. Any netflow software is going to interface with a device and collect the data. What is it that you think the difference between a probe and a collector is?

He's using pfSense, a software router, which requires adding a piece of software to analyze flows, turn them into NetFlows, and pass them along. You then need another piece of software to collect the NetFlows. Then you need yet another program to turn the collected flows into pretty graphs or otherwise usable data. He may not have the most clear choice of words, but there is a difference between the probe and collector. In my case I use softflowd on my pfSense box to create and send flows, flow-capture on a linux box to write the flows to disk, and FlowViewer to make sense of the flows.