Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Looking to see if Netflow compares to Wireshark

I am new to the Cisco environment and using sniffers. I am used to installing Wireshark on my PC and monitoring traffic for Instant Messaging. My new job I have to sniff traffic between one server to another server or PC. I currently setup port mirroring on a switch, plug in my PC into a port on the switch and run Wireshark. That is fine if I am at work and I want to carry my PC around but I now I am getting request for remote sites and sniffing their traffic. Can Netflow allow me to sniff one port on a switch and only log traffic from one ip address? Also can Netflow sniff Virtual servers?

Find more posts tagged with

Accepted answers

All comments

jswan

No, Netflow has no packet sniffing capability.

You might want to look at the new IOS embedded packet capture functionality in 12.4(20T) and later:

supportwiki.cisco.com/.../Tech_Insights:Utilizing_the_New_Packet_Capture_Feature

Donald_Francis

Netflow is more of a statistical tool.

Where wireshark actually captures the entire packet of a communication netflows are just a "report" of communications.

Basically after a flow ends the sending device will send information about that communication to a netflow collector. So it would be something like 1.1.1.1 talked to 1.1.1.2 on tcp port 25 for 15mins and transferred 5mb of data.

When you capture flows from a device you can quickly and easily build a good picture of what kind of traffic is going through a deivce and in what quantities.

For example, if you have a T1 that is always at 100% utilization you can look at the flow data and see what Ips are sucking away the bandwidth etc. It is just as useful as a packet capture and in many situations more useful especially when it comes to resource and capacity planning.