Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Incorporate Netflow Statistical Data, graphs

Incorporate Netflow Bandwidth Monitoring capabilities similar to what a product such as Netflow Analyser does.

Monitoring interfaces on devices (Routers/switches), being able to drill down to the IP address/packet/protocol level so that I know who is using the bandwidth, how much, how long and for what reason, ie.. Netmeeting, streaming video, audio, www, ftp, telnet, whatever.

Being able to drill down to know what devices are talking to what devices and what they are talking about would be a great enhancement to the Orion product.

Find more posts tagged with

Accepted answers

All comments

Debbi

You may be interested in this link, in which one vendor shows an integration possibility between Netflow Monitor and Orion. Yeah, I know, you have to buy Netflow Monitor. But just FYI.
www.netflow-monitor.com/.../

Debbi

Isaac

jim

look here for the very long wish list for future Orion enhancements:
http://www2.solarwinds.net/SolarWinds-Forum/topic.asp?TOPIC_ID=151

what your describing sounds like fairly deep packet analysis. this seems to be a bit outside the bounds of a network monitoring/availability product.

i do agree that it would be bad ass to have something like this integrated into Orion either internal to the app or via a partnership with Netflow.

be happy or fantastic whichever

Network_Guru

Thanks for the link Debbi.

That's just what we've been looking for!
I've not yet had a chance to eval Netflow Monitor, but haved tried NetQos Network Analyzer.
It's great product, but VERY pricey.

How long have you had Netflow Monitor?
Did you install it on the same server as Orion?
If not, does the web page integration still work with Neflow running a different server?

Can it create reports of top 10 talkers based on all monitored interfaces?
We want something that can check the backplane traffic on our 6513, as well as our WAN links for protocol/host matrix & create network wide reports, as well as tieing into Orion when you select an interface. Sounds like these 2 products integrate quite nicely....?

-=Cheers=-
NG

Isaac

Hello all,

I just downloaded and installed Netflow Tracker from Crannog Software on my Orion box. It works fabulously well for integrating with Orion.

Netflow Tracker is the big brother to Netflow Monitor referenced in Debbi's post. The product is version 1.0.3 so there are areas that require a bit more polish and a few issues in terms of performance that need working out. All in all it is a valuable product for deep analysis of traffic moving through a router or switch.

I went with two different routes to attempt a clean integration.

In the first instance I attempted to imbed the default device view inside Tracker into a Resource within SolarWinds. This worked to a certain extent but ended up looking sloppy and not being very useful (similar to imbedded journalists in the military).

My other approach was to create a custom property called Netflow_HTTP and populate that with a URL such as: <a target=_blank href=NETFLOW-SERVER:8080/report.jsp Stats</a>

While this approach requires that you enter this URL info for every device that has data in Netflow Tracker it also tends to be cleaner in terms of the Orion node view page.

NOTE: I have four core switches/routers (Catalyst 6506 with MSFC2 Native IOS) and three branch office routers (Cisco 3640) being monitored by Tracker for the last week. The database is already 3.5 GB. You may want to keep this in mind if you plan to store the data on the Orion server.

Network_Guru

Thanks for the info Isaac.

From what I've read, Netflow Tracker gives you detailed 1 minute stats and normally purges the data after a week.
Netflow Monitor on the other hand has 10 minute stat intervals & can keep the data for up to a year.

I will be installing the demo software on another server & just create a link to the device in the Node Details page using the IP address as you have.

Rather than entering the URL for every device, you can create a Custom Property - "Links"
Copy your URL into the Custom Property "Links" for the Nodes which are running NetFlow.
You can then display this Custom Property on the Node Details page using the ...Solarwinds\NetPerfmon\9-1-Miscellaneous\70-telnet.resource. (or what ever resource you are using to telnet &/or browse to the node)

I use the following code to display HTML documentation specific to each node;

<tr>
<td class="Property"><a target="_blank" href="")%>">Support">ORION-SERVER/<%=Node.GetProperty("Documentation")%>">Support Dox for <%=Node.GetProperty("NodeName")%></a></td>
</tr>

In the Custom Property "Documentation" is the rest of the URL to the node documentation published on the server; dox/location-xyz/node-troubleshooting-info.html
You can publish the full URL instead if the docs are located on various web sites - including external links. Of course this requires an entry for each device, but it's easier adding this info in Custom Property Editor.

In your case you could add the following code which would not even require a Custom Property to be created;

<tr>
<td class="Property"><a target="_blank" href="")%>">NetFlow">NETFLOW-SERVER:8080/report.jsp stats for <%=Node.GetProperty("NodeName")%></a></td>
</tr>

BTW. Have you tried the custom integration which is listed in Debbie's Post?

-=Cheers=-
NG

Isaac

Hi there GURU,

I did create a custom property and add it to the node view page just as you detailed in your post. What you said and what I said (I think) are the same thing.

Anyhow, I did not go the route of the custom integration provided by Crannog. When I spoke to their rep they said they had some issues in getting it to work. However, I suppose I should give it a whirl just in case.

BTW: How the hell do you find the time to post to this list so often? You must drink a boat load of coffee/Mt Dew/Red Bull.

Network_Guru

quote:Originally posted by Isaac

Hi there GURU,

BTW: How the hell do you find the time to post to this list so often? You must drink a boat load of coffee/Mt Dew/Red Bull.

Hey Isaac - it's called Bawls! :-D
http://www.thinkgeek.com/interests/bawls/
(Actually I'm on the West Coast, so it's not really that late)

All kidding aside, I've been on this forum almost since it started (as I see you have as well):

- Member Since: 07/14/2003
- Total Posts: 471
- 0.74 posts per day

All it takes is a couple of posts every other day or so...

I think I suggested pretty much the same thing as you were doing, but I threw mine in the ring, just in case...
Sometimes it helps to look at the same thing from 2 different angles.

It's nice to have another Guru around to answer some questions.
I also really miss Ian Underwood's input. Not sure what happened to him, but he has some great code & ideas.

-=Cheers=-
NG

iceman

Hi.

This is more of a Netflow Tracker Support ?, but having issues seeing any data being exported from my 6513 (running hybrid btw)

The CAT tells me data is being exported. Here's the output from the CAT CLI:

rv-bp-ifsw-01> (enable) sh mls nde
Netflow Data Export version: 7
Netflow Data Export enabled
Netflow Data Export configured for port 5000 on host 192.168.102.110
Total packets exported = 29
Destination Ifindex export is enabled
Source Ifindex export is enabled
Bridged flow statistics is enabled on vlan(s) 102.
Bridged flow statistics is disabled on vlan(s) 1,100-101,103-116,120,200.
rv-bp-ifsw-01> (enable)

Any ideas would be appreciated... thanks

Isaac

Hello iceman,

Unfortunately I am running Native IOS on all of my core switch/routers so I can't give you a complete list of steps to get your Hybrid box up.

However, as always I will attempt to muddle (is that how you spell muddle) through.

Native IOS relevant config:
mls aging long 300
mls aging normal 128
mls flow ip interface-full
mls nde sender
mls nde interface

ON THE INTERFACE(s) YOU WISH TO MONITOR:
START
interface GigabitEthernet1/2
ip route-cache flow
STOP

ip flow-export source Vlan1
ip flow-export version 6
ip flow-export destination 134.156.xx.xx 2055

You can also find a happy document that will assist you in setting netflow up on the crannog website at:
http://www.crannog-software.com/productdetail.cfm?ProductDetailId=1&ProductId=1

Be fantastic.

To the Guru:
Do you actually consume that stuff or are you just fond of the bawls T-Shirt?

iceman

Thanks Issac.

We are exporting Netflow from two 3550's to the Netflow Tracker Server.

One 3550 is in DMZ and the other is in the Backend. The information to this point is useless.

We were hoping to catch conversations between the DMZ and the Internal networks, but no dice. We only see Gateway and Broadcast info.

I was hoping this product was like a sniffer.

iceman

Just an update.

Flow Tracker does not support the CAT 3550's for flow-control (per vendor)

Will try this on the 6513's.

aLTeReGo

NetFlow support native in the Solarwinds product would be AWSOME!!

Isaac

iceman,

Did you get the 6513 to work? If not I have a few contacts at Crannog I could put you in touch with for support.

aLTeReGo,

That would be awesome. However, it would also be completely outside the realm of Orion's product space. It would add 10,000+ to the price tag for Orion. For all us kids out here in the cold world with continually declining IT budgets that would be a back breaker.

I want custom mibs! Argh!!!

Network_Guru

quote:The Wise and Noble Isaac has posted

<snip> It would add 10,000+ to the price tag for Orion. For all us kids out here in the cold world with continually declining IT budgets that would be a back breaker.

I want custom mibs! Argh!!!

Adding custom MIBs would also increase the value of this product dramatically!
This would facilitate the need for an Orion - Silver, Gold or Platinum edition, depending on your budget & the features required.
<jk>

-=Cheers=-
NG

chris.conway

As the person who wrote the integration docs for the page that Debbie referred to http://www.netflow-monitor.com/literature/

I can now tell you that we have now re-written the Orion Resource file we use so that it is more efficient. We've also used the Custom Properties feature of Orion to help with this.

We also now have integration worked out with the Plixer Scrutinizer product. http://www.netflow-analyser.co.uk for info. The site is currently under development, so if you can't find what you need, let me know

Chris

Don331

Where's the intergration doc for the Plixer Scrutinizer?

Don Barry
Aegis Mortgage Corp
Houston, TX

aLTeReGo

Agreed this would add cost, and perhaps I shouldn't have said native. What I think would be cool is if SolarWinds made a Netflow product that tightly integrated into Orion. That way those people who would otherwise buy a separate Netflow application could instead have it as a pay-for bolt-on into Orion. I'm willing to pay as long as the price is reasonable in comparison to competitor’s products.

quote:Originally posted by Isaac

iceman,

Did you get the 6513 to work? If not I have a few contacts at Crannog I could put you in touch with for support.

aLTeReGo,

That would be awesome. However, it would also be completely outside the realm of Orion's product space. It would add 10,000+ to the price tag for Orion. For all us kids out here in the cold world with continually declining IT budgets that would be a back breaker.

I want custom mibs! Argh!!!

chris.conway

quote:Where's the intergration doc for the Plixer Scrutinizer?

I'm currently in the process of writing it at the moment.

jneiberger

In addition to looking at Orion NPM, we are also looking at getting a NetFlow monitoring application. I downloaded demos of the ManageEngine NetFlow Analyzer, as well as Crannog's NetFlow Tracker. I first installed the ManageEngine product and saw how cool it was. Very, very nice! I then installed the Crannog application and it stayed on my computer for about ten minutes before I uninstalled it.

If you get a chance, you must take a look at AdventNet's ManageEngine NetFlow Analyzer. Extremely cool product.

With that being said, I would gladly pay more for Orion NPM if it had NetFlow analysis built-in. In fact, it would make it a no-brainer. I'm not convinced that some of NPM's drawbacks wouldn't eventually drive me crazy, but the addition of NetFlow would certainly tip the scales in NPM's favor!

Unfortunately for us, I *love* the ManageEngine product, so we're probably going to buy it pretty soon. So, I guess what I should be asking for is integration between NPM and NetFlow Analyzer.

Seriously, NPM looks like a pretty neat product, but the addition of NetFlow would just kill everything else in the market. No one would buy anything else, except for the people who don't like Windows products. I would prefer a linux version, but I'm willing to at least give NPM on Windows a shot.

John

Network_Guru

I've been evaluating several different Netflow products over the past year, and I must agree with John, NFA has the best GUI of all that I have tried.
The biggest downfall with NFA is that the links are dynamic Java applets that cannot be easily integrated into Orion.
Crannog does have this capability, but the UI is no where near as well written & user friendly as NFA.
NetQos is a good product but at over 10 times the price of NFA, it is very hard to justify purchasing the app & appliance.

One other product which seems very promising is Scrutineer, which was just released 3 weeks ago. I've downloaded the demo, but have not yet installed it.

As for the Orion product including Netflow, I'm sure the folks at Solarwinds can see the huge benefit to adding this to their arsenal of Network Monitoring Tools.
I wouldn't be surprised if they came out with a NetFlow solution within the next year.
The majority of requests in this forum have been or are being addressed by the Solarwinds development team (Report Writer, CPE, Custom Mibs, etc).

...one can only request & wait.

-=Cheers=-
NG

grisu

Hello Network_Guru

From which company is the Scrutineer, can't find it.

Best regards

grisu

Network_Guru

quote:Originally posted by grisu

Hello Network_Guru

From which company is the Scrutineer, can't find it.

Best regards

grisu

Sorry, my bad - it's called Scrutinizer (as per the other post in this thread).
They have even written a custom web interface for Orion:

www.plixer.com/.../scrutinizer_solarwinds.php

-=Cheers=-
NG

jneiberger

WHOA! Have you looked at the server requirements for Scrutinizer? It requires 40 GB for the application alone, and 80 GB of storage for the Enterprise version of the product. Yowza!

It looks pretty cool but it's not as nice as NFA. However, the ability to integrate it with Orion--not to mention the lower price--might overcome any shortcomings.

John

chris.conway

Hi NG,

I noticed you used a screenshot of our Orion integrated with Scrutinizer there and not the one on the Plixer site.

Is there any reason for this? It's not a problem, just curious.

Chris

Network_Guru

quote:Originally posted by asl-support

Hi NG,

I noticed you used a screenshot of our Orion integrated with Scrutinizer there and not the one on the Plixer site.

Is there any reason for this? It's not a problem, just curious.

Chris

Hey Chris,

The screenshot on the Plixer site does not show the Netflow graph:

It seems like the Plixer website is not completely finished.

-=Cheers=-
NG

martek01

I have been playing with Netflows for about 3 weeks and have been getting good results using Open Source software. My configuration looks like this:

Dell GS150 w/512MB RAM (from the junk pile)
OS: FreeBSD v6.0
NetFlow Collector: Flow-Capture (Flow-Tools)
Database: RRD Tool
Flow Converter: FlowScan
Graphing Tool: CUFlow

I have configured our internet router, a Cisco 3600, to export flows to this box and it is working great. I also setup Cacti and am grabbing SNMP data from the router at the same time. It's not nearly as nice as Orion but it was fun to work with.

Evans Martin
Metro Gov't of Nashville, TN & Davidson County

---
Evans L. Martin - IS Analyst
Metro Govt. of Nashville, TN & Davidson County
615.862.4066 Office 615.862.6288 Fax AOL AIM: Martek01

ggroen

Network_guru, Is it possible to tell us how you have written it? Because we can integrate it also then?

Network_Guru

quote:Originally posted by ggroen

Network_guru, Is it possible to tell us how you have written it? Because we can integrate it also then?

Sorry ggroen, but the answer is no.

If you read the rest of this post, you will see that Plixer has written the code to do this. I had nothing to do with this web integration, other than pointing it out to everyone on these forums.

-=Cheers=-
NG