If you’ve ever experienced the frustration of trying to identify exactly which workstation is clogging up your network with torrent downloads, then examining NetFlow data on your network could help you out. NetFlow can help admins find out exactly what kind of traffic is on the network, and who is consuming all your precious bandwidth.
We’ve pulled together a few free tools that collect and analyze NetFlow data. We’ve tried to find tools that are truly free, and not just time-limited evaluation versions. Though not time-limited, most of the tools are feature-limited versions of products from the software makers. Don’t let that discourage you though. All of these software packages are well worth downloading, even with the limitations.
But before we get to the tools, a brief overview of NetFlow is in order.
What is NetFlow/J-Flow/sFlow?
NetFlow data is generated by network devices like routers and firewalls. Flow data will generally contain details like source and destination IP addresses, port numbers, protocols, and more.
Implementation details vary from vendor to vendor, but most flavors of xFlow produce the same sort of data. In this article, we’ll refer to all xFlow variants as NetFlow to keep things simple, but be aware that not all tools support the same flavors of Flow.
How to Enable NetFlow
Before you can use one of the free flow analyzers, NetFlow must be enabled on the devices you want to monitor. Don’t worry, it’s not hard. The steps to enabling NetFlow vary from device to device and there’s a wealth of information on the web to get you started.
For Cisco devices, start with the Cisco Netflow Configuration Guide.
Other vendors, like Juniper, usually have their own configuration resources too.
Now, on to the free tools!
Most Downloaded Free NetFlow Tool: SolarWinds NetFlow Traffic Analyzer
The SolarWinds NetFlow Traffic Analyzer is another great tool from a company with a history of making reliable network monitoring software. Data can be sorted, displayed, and charted in different ways – such as conversations, and endpoints.
Limitations: Monitor only a single NetFlow interface, and keeps 60 minutes worth of data.
Free NetFlow Tool #2: ManageEngine NetFlow Analyzer Professional
ManageEngine offers a full-featured, free version of their NetFlow Analyzer Professional software. The free version displays detailed source/destination data, as well as ports used, and applications detected. It also generates helpful charts that make it easy to visualize the data.
Limitations: Monitors only two interfaces. But, for the first 30-days it can monitor unlimited interfaces.
Free NetFlow Tool #3: ntop
“ntop” is an open-source NetFlow analyzer and packet capture product. It took a little more effort to get up and running than some of the other software, but is a great open-source alternative. The data is analyzed and presented in a clear and logical way, even though it doesn’t have all the visual bells and whistles of some other products.
Limitations: None if you download and compile it yourself – source code can compile on Linux or Windows. But if you want an executable binary file, then you’re limited to capturing 2000 packets, unless you register (erm, donate).
Free NetFlow Tool #4: Paessler PRTG
PRTG is a full network monitoring system. The free version includes a NetFlow sensor, in addition to many other features like reporting, alarming, and SNMP monitoring. The free version can monitor up to 10 sensors at no cost.
Limitations: Limited to 10 sensors (or 20 if you display the PRTG graphic on your website)
Free NetFlow Tool #5: Plixer International Scrutinizer NetFlow and sFlow Analyzer
Scrutinizer is another comprehensive NetFlow analyzer. The download was surprisingly large – a hefty 322 MB compared to 44 MB for PRTG and a lightweight 20MB for SolarWinds. There were numerous tutorials and videos included in the product, so that could have been part of the reason for the bulk. But, it also is a very comprehensive tool that provides detailed traffic analysis.
Limitations: Provides only 24 hours worth of data. Unlimited data and more advanced reporting and alarming is available with the add-on “Flow Analytics” package.
We tried out all of these products, and were impressed by each and every one. If you’re looking for a way to manage your bandwidth more efficiently, then enable NetFlow on your network and download one of these analyzers. It’s worth it even if only to have a close peek into what kind of data really is flowing over your network.