netflow analysis tool

[S891]

Hi,

what is the best available tool for netflow monitoring and specially for troubleshooting issues using flow analysis? I am looking for something that works well on small network of 200 devices. 

Thanks

[Marvin Rhoads · Accepted solution]

200 devices total probably means only one or two Netflow exporters and a likewise small budget. :)

I'd take a look at Paessler's PRTG. It's a general purpose network management tool that also will collect and allow you to visualize Netflow (v5, v9 and the NSEL format used by Cisco ASA).

Other highly regarded but slightly more expensive tools are SolarWinds NTA or Plixer Scrutinizer. You can also use Prime Infrastructure with Assurance licenses though it will (ironically) not understand NSEL record types.

[S891]

Thanks, Marvin. Just a quick look at the capabilities tells me that Plixer Scrutinizer has a lot of capabilities. Do you think there will be much difference in pricing for PRTG vs Plixer? 

[Marvin Rhoads]

Easy enough to request a quote from both companies but from what I've seen, PRTG will be less cost. Its Netflow capability is simple but then it also does lots of other things - querying and graphing anything your can get with SNMP.

Scrutinizer is a purpose built tool for flow analysis. It costs a bit more but gives you a lot more functionality if flow analysis is what you need to do. It won't also serve as your general purpose network management tool however. PRTG can do that.

Both tools have trial downloads to try before you buy.

[S891]

Perfect !!! I will ask for quote and also try it. thanks for the info. 

[kerstin-534]

NFDUMP with NFSEN is open source and very optimized for fast troubleshooting using tcpdump like filters. NFUMP can be used in networks of any size. It is very suited for ASAs NSEL format.

[Michael Patterson]

Regarding your question "what is the best available tool for netflow monitoring", I think the word best depends on your definition.  Being from Plixer, I agree with Marvin that Scrutinizer has "a lot more functionality" but, it could be overkill.  You should try both.