4 Replies Latest reply on Oct 1, 2009 8:39 PM by tcoach

    Netflow

    tbaggins

      Has anyone out there that has Netflow installed ever worked with a Cisco MARS appliance?  Do the two compare?  Economically the MARS box is NOT the way to go, but the application doesn't seem to give me all I need from a "hunt the file sharing fools down" perspective.    

        • Re: Netflow

          i feel MARS is excellent at correlating events to find the culprits with less digging.


          -kuperstock

          • Re: Netflow
            scraig84

            They really aren't competing products.  MARS is a security product and uses NetFlow as one part of gathering information.  MARS is more about gathering info from different systems and correlating events and data so that action can be taken - potentially automated action at that.


            NTA is going to give you a view into what's going on with your network, but you're right that NetFlow alone is often not enough as it often takes more intelligence for the tool to understand certain types of traffic to be a specific application.  The best tools I've seen for this are actually in the QoS/Bandwidth Optimization space.  Tools such as Packeteer's Packetshaper do a great job of identifying and quantifying application traffic.

              • Re: Netflow
                SLXer

                We have Cisco Mars implemented in our environment and frequently root out peer to peer and other spyware type activity. While the product is a powerful correlation tool, something its not is... user friendly..

              • Re: Netflow

                I have both devices, the MARS box we use for security and high level eval of our network, but what we have found over time is that it does not offer some of the finer details we wanted to see. The Netflow does that with a considerably less cost than the MARS box, both are great tools if used correctly.