[27832] in North American Network Operators' Group
Re: Cisco Netflow Analysis Software
daemon@ATHENA.MIT.EDU (Thomas P. Brisco)
Wed Mar 15 13:35:17 2000
Date: Wed, 15 Mar 2000 13:32:26 -0500 (EST)
From: "Thomas P. Brisco" <brisco@globix.net>
To: David Hares <dhares@networktwo.net>
Cc: nanog@merit.edu
In-Reply-To: <OKEDJGFADPJBOBIMOKCFCEJOCIAA.dhares@networktwo.net>
Message-ID: <Pine.GSO.4.21.0003151322300.6462-100000@hq.globix.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Errors-To: owner-nanog-outgoing@merit.edu
I wouldn't bother with cisco's commercial product. Trying
to use that to track real-world flows is like trying to use a
kitchen sieve to empty Lake Champlain.
A) It seems to barf on datasets > ~1.2GB
(the error message was similar to "32478236924")
B) Regular java blowups with things like
formatNumberException (for big sums)
and other java exceptions. This typically
causes the app to lose sanity, requiring you
to quit and restart it.
C) The functionality is weak
there's no way to ask for very specific info
(e.g. tell me only about AS6172)
sorting doesn't put the two halfs of flows together
(i.e. you can sort only by either src or dst as)
D) stores data in a "different" ASCII format - so the
freeware tools aren't usable (at least not that
I've found the "real" data so far ...)
You're better off with the freeware stuff - if you need/want
graphs/charts you can always pipe through sed/perl and into
gnuplot... [see later messages for the freeware stuff]
- TP
On Wed, 15 Mar 2000, David Hares wrote:
> Date: Wed, 15 Mar 2000 12:04:29 -0500
> From: David Hares <dhares@networktwo.net>
> To: nanog@merit.edu
> Subject: Cisco Netflow Analysis Software
>
>
> Does anyone have or know of a cisco Netflow collector/reporter available in
> the public domain?
>
> Cisco used to have a basic one available on their website, but now that that
> they have a commercial product using Netflow, the free software is gone.
>
> Dave
>
> -----------
>
> David Hares
> NetworkTwo Communications Phone: 734.827.3620
> 650 KMS Place FAX: 734.827.3690
> Ann Arbor, MI 48108 Email: dhares@networktwo.net
>
>
