Re: Looking for Netflow analysis package

2013-05-20 Thread Rinse Kloek
Op 20-5-2013 0:40, Cameron Daniel schreef: On 2013-05-17 8:11 pm, Tim Vollebregt wrote: Is anyone using an open source solution to process netflow v9 captures? I'm waiting for SiLK v3 for some time now, which is currently only available for TLA's and Universities. Currently looking into

Re: Looking for Netflow analysis package

2013-05-19 Thread Cameron Daniel
On 2013-05-17 8:11 pm, Tim Vollebregt wrote: Is anyone using an open source solution to process netflow v9 captures? I'm waiting for SiLK v3 for some time now, which is currently only available for TLA's and Universities. Currently looking into nfdump. To drag this back on topic, yes I'm

Re: Looking for Netflow analysis package

2013-05-18 Thread Jimmy Hess
On 5/17/13, Scott Weeks sur...@mauigateway.com wrote: owned resources. So don't. Set up an SSH tunnel over port 80 to your home server and access your non-paragraph-sized-signature email account from home. There's a million ways to do things and still follow corporate rules... The

Re: Looking for Netflow analysis package

2013-05-18 Thread Valdis . Kletnieks
On Fri, 17 May 2013 10:02:53 -0700, John Starta said: Do you believe that Brent wrote the disclaimer attached to his message? Despite y/our opinions of such disclaimers, legal counsel in some companies still mandate their automatic attachment on all outbound messages. The only means of

Re: Looking for Netflow analysis package

2013-05-17 Thread Tim Vollebregt
Is anyone using an open source solution to process netflow v9 captures? I'm waiting for SiLK v3 for some time now, which is currently only available for TLA's and Universities. Currently looking into nfdump. Tim On May 17, 2013, at 12:16 AM, Scott Weeks wrote: Does anyone know of a netflow

Re: Looking for Netflow analysis package

2013-05-17 Thread JP
On Fri, May 17, 2013 at 12:11:57PM +0200, Tim Vollebregt wrote: Is anyone using an open source solution to process netflow v9 captures? I'm waiting for SiLK v3 for some time now, which is currently only available for TLA's and Universities. pmacct does this pretty nicely (along with a

Re: Looking for Netflow analysis package

2013-05-17 Thread Harry Hoffman
Check out argus http://www.qosient.com/argus/ Netflow v9 support was added within the last few months. Cheers, Harry On 05/17/2013 06:11 AM, Tim Vollebregt wrote: Is anyone using an open source solution to process netflow v9 captures? I'm waiting for SiLK v3 for some time now, which is

Re: Looking for Netflow analysis package

2013-05-17 Thread Valdis . Kletnieks
On Thu, 16 May 2013 15:16:22 -0700, Scott Weeks said: You haven't been here long have you... He DOES NOT need a 260 word signature (see below!) to make sure he does not get UCE from posting to NANOG. Actually, I think Thomas Cannon was making the opposite point - that if he's going to spam

Re: Looking for Netflow analysis package

2013-05-17 Thread John Starta
On May 17, 2013, at 8:24 AM, valdis.kletni...@vt.edu wrote: On Thu, 16 May 2013 15:16:22 -0700, Scott Weeks said: You haven't been here long have you... He DOES NOT need a 260 word signature (see below!) to make sure he does not get UCE from posting to NANOG. Actually, I think Thomas

Re: Looking for Netflow analysis package

2013-05-17 Thread Phil Fagan
Well put. On May 17, 2013 1:54 PM, John Starta j...@starta.org wrote: On May 17, 2013, at 8:24 AM, valdis.kletni...@vt.edu wrote: On Thu, 16 May 2013 15:16:22 -0700, Scott Weeks said: You haven't been here long have you... He DOES NOT need a 260 word signature (see below!) to make

Re: Looking for Netflow analysis package

2013-05-17 Thread Scott Weeks
On May 17, 2013 1:54 PM, John Starta j...@starta.org wrote: On May 17, 2013, at 8:24 AM, valdis.kletni...@vt.edu wrote: On Thu, 16 May 2013 15:16:22 -0700, Scott Weeks said: He DOES NOT need a 260 word signature (see below!) to make sure he does not get UCE from posting to NANOG.

RE: Looking for Netflow analysis package

2013-05-16 Thread Meshier, Brent
Laura, Do not appreciate the cold call from Plixer. Please do not use the NANOG mailing list as your personal directory for sales leads. It's a sure fire way to get your company blacklisted among IT professionals. --Brent -Original Message- From: Laura Smith

Re: Looking for Netflow analysis package

2013-05-16 Thread Thomas Cannon
That wasn't in your signature's disclaimer. Perhaps now would be a good time to add it? Geez. --tc On May 16, 2013, at 11:29 AM, Meshier, Brent bmesh...@amherst.com wrote: Laura, Do not appreciate the cold call from Plixer. Please do not use the NANOG mailing list as your personal

Re: Looking for Netflow analysis package

2013-05-16 Thread Scott Weeks
Does anyone know of a netflow collector that will do the following. snip -Original Message- From: Laura Smith [mailto:leavingi...@yahoo.com] UCE snipped out -- -Meshier,

RE: Looking for Netflow analysis package

2013-05-15 Thread Scott Berkman
I'd also suggest looking at NetFlow Auditor: http://www.netflowauditor.com/ I think it will do all of those except AS path analysis. Another good option might also be the InterNAP FCP, which does all of that PLUS optimizes routing based on the data (can also be deployed in a preview mode):

Re: Looking for Netflow analysis package

2013-05-15 Thread Jon Wolberg
I can vouch for the FCP. I haven't used their newer platforms but the device worked very well. On Wed, May 15, 2013 at 10:50 AM, Scott Berkman sc...@sberkman.net wrote: I'd also suggest looking at NetFlow Auditor: http://www.netflowauditor.com/ I think it will do all of those except AS

RE: Looking for Netflow analysis package

2013-05-14 Thread David Hubbard
The Netflow analyzer from Solarwinds works pretty well for all of that provided you're receiving the data from a Cisco source that does netflow v9. It is not very useful at all for sflow though because they haven't updated it to recognize the ASN data. Their sales staff will also hound you

Re: Looking for Netflow analysis package

2013-05-14 Thread Mike Hale
Solarwinds netflow is also way, way overpriced for what you get...and their license model for Netflow is utterly ridiculous. I like Splunk plus Netflow integrator. With some custom lookup tables, you might be able to code up a view that'll show you the per-ASN stats. You can definitely do it by

Re: Looking for Netflow analysis package

2013-05-14 Thread Ravi Pina
While it doesn't do everything you're looking for nfsen[1] is pretty extensible. [1] http://nfsen.sourceforge.net/ On Tue, May 14, 2013 at 10:59:32PM +, Erik Sundberg wrote: Does anyone know of a netflow collector that will do the following. *Graph/List Destination Networks By Top AS

RE: Looking for Netflow analysis package

2013-05-14 Thread Warren Bailey
Where are all my ntop brethren? Sent from my Mobile Device. Original message From: David Hubbard dhubb...@dino.hostasaurus.com Date: 05/14/2013 4:12 PM (GMT-08:00) To: nanog@nanog.org Subject: RE: Looking for Netflow analysis package The Netflow analyzer from Solarwinds

Re: Looking for Netflow analysis package

2013-05-14 Thread David Edelman
Take a look at argus www.qosient.com Dave Edelman On May 14, 2013, at 19:17, Mike Hale eyeronic.des...@gmail.com wrote: Solarwinds netflow is also way, way overpriced for what you get...and their license model for Netflow is utterly ridiculous. I like Splunk plus Netflow integrator.

Re: Looking for Netflow analysis package

2013-05-14 Thread Joe Loiacono
Check out the FlowViewer/flow-tools/SiLK combo also. https://sourceforge.net/projects/flowviewer/ Erik Sundberg esundb...@nitelusa.com wrote on 05/14/2013 06:59:32 PM: From: Erik Sundberg esundb...@nitelusa.com To: nanog@nanog.org nanog@nanog.org Date: 05/14/2013 07:00 PM Subject: Looking

RE: Looking for Netflow analysis package

2013-05-14 Thread Harry Hoffman

Re: Looking for Netflow analysis package

2013-05-14 Thread shawn wilson
Not exactly netflow until you set it up as such buy, Graylog2 and LogStash are OSS. Also, I'll probably be releasing modules and a simple evented (POE) program in perl soon (don't wait up if you can't deal with code - it ain't and ain't going to be a web app but a simple framework mainly for the

Re: Looking for Netflow analysis package

2013-05-14 Thread Jason Lester
ManageEngine's NetFlow Analyzer will do most of that (not sure about AS Path Analysis.) It is priced per monitored interface, but is pretty reasonable for what it does. They have a 30-day demo available. We use their full OpManager+NetFlow suite to monitor several hundred devices with thousands

Re: Looking for Netflow analysis package

2013-05-14 Thread randal k
We use/d nfsen extensively for this this past November December and have been very successful in planning our bandwidth purchases since then. We like it so much that reliable, full-speed Netflow telemetry is now a requirement on all edge/core routers. Randal On Tue, May 14, 2013 at 8:18 PM,

Re: Looking for Netflow analysis package

2013-05-14 Thread Rubens Kuhl
On Tue, May 14, 2013 at 11:18 PM, Jason Lester jles...@wcs.k12.va.uswrote: ManageEngine's NetFlow Analyzer will do most of that (not sure about AS Path Analysis.) It is priced per monitored interface, but is pretty reasonable for what it does. They have a 30-day demo available. We use

Re: Looking for Netflow analysis package

2013-05-14 Thread Peter Phaal
You might want to take a look at pmacct, http://www.pmacct.net/. It includes an embedded version of Quagga, allowing BGP AS Path data to be efficiently joined with flow records. Peter On Tue, May 14, 2013 at 3:59 PM, Erik Sundberg esundb...@nitelusa.comwrote: Does anyone know of a netflow