netflow and cacti

Guest · Posted: Fri Nov 15, 2002 7:24 am Post subject: netflow and cacti

Does anyone know of a module, which can analyse netflow files (e.g. from flow-tools) and process the data for cacti?

wesphillips · Joined: 28 May 2002 Posts: 21

I am using flowscan. It takes the output files from flow-tools nad parses through the data and creates rrd files for you. All you ahve to do is create an inactive data source that points to the rrd and create a graph based on that DS.

go to
http://net.doit.wisc.edu/~plonka/FlowScan/

kbowerman · Joined: 20 Oct 2003 Posts: 3

olavl · Joined: 08 Oct 2003 Posts: 2

Very off topic, since this is not Cacti related at all. But here is some netflow, flow-tools and flowscan info:
http://www.caida.org/tools/utilities/flowscan/
http://www.linuxgeek.org/netflow-howto.php
http://www.ncne.org/training/techs/2002/0127/presentations/200201-fullmer1_files/v3_document.htm
http://netflowguide.com/?page=guide

flow-tools is a software package with tools for capturing and extracting information from netflow, flow-scan is a module for graphing netflow captures.

CaM · Joined: 11 May 2006 Posts: 6

I understand there is a large gap between my post and the last but thought I'd pop it on anyways

I just got CactiEZ Beta CD from http://cactiusers.org/forums/topic281.html

After installing it I noticed the clever ones had already configured everything including flow-tools at which point I found "FlowViewer" at http://ensight.eos.nasa.gov/FlowViewer/

Once installed and configured for our setup I added http link into cacti using the ntop plugin.

Nice as it allows me to answer who/what was actualuy causing the graphs to peak at 3am in the morning! nice!

What a tool cacti is eh! well chuft with it!

knobdy · Cacti User Joined: 28 Sep 2005 Posts: 495

cigamit · Posted: Wed May 24, 2006 8:25 pm Post subject:

CaM · Joined: 11 May 2006 Posts: 6

knobdy: Yep just using the url link from the NTOP plugin. Maybe other plugins around to do it but was quick and dirty way to show the boss.

cigamit: that sounds good. nah dont use the flowgrpah! like you say not much use for it. If you want me to do any testing then give us a shout....

knobdy · Cacti User Joined: 28 Sep 2005 Posts: 495

Yeah, and post it soon!

cigamit · Posted: Thu May 25, 2006 6:41 pm Post subject:

qwertz · Cacti User Joined: 16 Feb 2006 Posts: 98

Where can we find your webiste?

Thanks

QWertz

cigamit · Posted: Mon May 29, 2006 5:28 pm Post subject:

qwertz · Cacti User Joined: 16 Feb 2006 Posts: 98

Thanks i didin't know that it was your webserver

cigamit · Posted: Wed May 31, 2006 11:38 pm Post subject:

BTW, updated it tonight. Now it adds DNS Support to the reports. It implements a local caching of IP addresses to a MySQL Table that only resides in memory (HEAP) so its really fast. You will want to set the DNS server, under the "Misc" settings though. Cleans out any stale DNS entries after 1 hour.

Next I will add the abilty to "Save" a report/query so that it can be ran again (an issue with the times is the only thing I have to work out), which leads me to the next feature. Running those saved reports on a schedule and then emailing them.

I also plan on adding "Save to File" support, which should be fairly simple.

CaM · Joined: 11 May 2006 Posts: 6

Hey cigamit!

well after thinking about my previous post I realised you was the clever one who built CactiEZ CD. All I can say is a very big thankyou and I will try my hardest to make my firm aware of yours and your counterparts excellence and donate enough to such a worthy tool and the whole open source community! my firm are beginning to see that we can no longer overlook Open Source solutions.

Again a big thankyou. I hope to PM you soon with some good news....

flowview - again thanks, it works a treat however I was wondering. I work for a international law firm with 12 offices and a fair amount of windows based server. The netflow data is being collected from routers mostly across 2Mb leased lines and a lot of data is hitting CactiEZ flow-tools hence my reason to move Cacti on to one box and move flow-tools off my main cacti server onto its own. Personally I use flowviewer as a web page on a CactiEZ box and link to it from my main Cacti server (windows 2003 Srv, Apache).

The flowview plugin works a treat on the CactiEZ box but would be nice if I could achieve the same from your plugin.

Is it acheivable to have the Flow Tools Binary Path, Flow Tools Work Directory etc. on a remote host.

reading this back to myself I realise i waffle alot......sorry!