6 Replies Latest reply on Aug 4, 2014 4:58 PM by aaswi

    ORION+SNIFFER

    t3telecom

      Hi All.

      We have Lan to Lan links and we need to know the flow passing through those L2L links. We have also cisco L3 switches as our Core in the network but it doesn't support "IP NET FLOW" command.

        • Re: ORION+SNIFFER
          jaimeaux

          What kind of switch are you running at your core? If it doesn't support netflow then it won't work.

          • Re: ORION+SNIFFER
            darragh.delaney

            Hi t3telecom

             

            Even if your switch does not have flow features you still have a couple of options. Cisco switches support SPAN sessions and this means you can either mirror ports or VLANs to one or more ports. Lets say you want to monitor VLAN 1 and you have a sniffer (more about this below) connected to port 10. To get monitoring in place you just need to issue these commands

             

            monitor session 1 source vlan 1 both

            monitor session 1 destination interface GigabitEthernet0/10


            Your next step would be to pick a tool to connect to the SPAN port and there are many to pick from. SolarWinds have just included packet capture capabilities in NPM 11 and it focuses on gatering timing and application name information. There is an interesting discussion about it on this page. You will see top level info like what apps are using bandwidth.

             

            Another option would be to connect LANGuardian to the SPAN port. It focuses on users and applications and gives you in widget drilldown so you can go from top level application info and drill right down to see flow or application metadata. You can see a demo of it here which also shows how it can be integrated with Orion. Both NPM and LANGuardian are available as trials which you can download and see if any meets your requirements.

             

            Hope this helps,

            Darragh

            1 of 1 people found this helpful
            • Re: ORION+SNIFFER
              t3telecom

              Hi we have six sites each one running a deferente kind of switch as follow:

               

              WS-C3560G-24TS-E

              WS-C4507R+E

              WS-C3560G-48TS-E

              WS-C4507R+E

              WS-C6509-E

              WS-C3560G-24TS-E

               

              I'm trying to work with PRTG. It is good but since we already have SolarWins Orion running here. I thought I can work with mirror port and see the follow through one SolarWins Orion.

                • Re: ORION+SNIFFER
                  jaimeaux

                  With the 4570's and the 6509's you may need a supervisor card to enable netflow.

                    • Re: ORION+SNIFFER
                      aaswi

                      the 4500's and 6500's support netflow pending the sup modules. correct me if i am wrong, i think only the sup 6 does NOT support net flow. 

                       

                      also be aware LAN-Base licenses will not support exporting of net flow data. Hence, will not accept net flow cmd's.  Please be sure you have IP-Base licenses installed.