Monitoring flows WITHOUT netflow

[DeeL]

Hi all,

We've been using Cacti for quite a long time now and we're getting pretty used to it.

Time has come for us to dig a little bit deeper into our networks and to setup a flow monitoring platform. Our network is flat and we only own one L3 equipment, a FW, which obviously acts as our default gateway.
It "can not" handle netflow and I was just wondering if there was a way to accurately monitor our network flows/streams using some protocol analyser and to "connect" it with Cacti.

On a white page the whole thing seems easy:

1/ The FW has 4 main connections , LAN, MPLS VPN, @ and DMZ, I can mirror any of these connections to 4 NICs of a server powerfull enough to handle the 4 protocol analysis.

2/
a)On the LAN side, for now, I just want to list and graph the protol which are used, similar to what Ntop can do actually.

b)On the MPLS VPN, I want to merge 10 protocols into 3 categories of "graphed" protocols in order to check whether the CoS of this quite expensive VPN are Ok or not.

c) On the Internet, well it's allways usefull to check the protocol actually used, and to check the global bandwidth used (Cacti could do it by itself)

d) on the DMZ it's also usefull to see which protocol is used and by whom.


Is there any plugin for this project ?

Regards,

DeeL

[egarnel]

Have you looked into ntop?

[DeeL]

Hi Egarnel,

Yes I did but couldn't find a way to group different protocol into a same category that could be graphed. You think nTop can do the trick ?
I'm going te recheck.

Regards,

Deel

[DeeL]

Hu oO?