NetFlow is one of the most popular technologies for network monitoring and traffic analysis. If you have intelligent switches and/or routers, they may support NetFlow. When your network grows to the point that seeing what’s going on has become tricky, tools leveraging NetFlow may be the solution. Here we’ll explain what traffic monitoring and analysis are about, and we’ll round up the best NetFlow analyzers and collectors that are free on Windows.
Intro to traffic monitoring and analysis
Why can’t I get to Google? Why is the network slow? Did that server just go down? Is that old switch failing?
Uh oh – is there something funny going on?
With the street traffic outside your location, it’s usually obvious what’s going on. Personal vehicles come and go; delivery trucks arrive, drop off items (or pick them up), and leave. If traffic is slow or backed up, you can usually see the problem – an accident, road construction, a failed traffic light, etc.
Network traffic is different. What’s going on inside your network is a black box to the average person. The lights on the boxes shine and blink, and even if you know what they mean they provide minimal information.
If you’re responsible for keeping the network up and performing well, it can’t be a black box to you – you need visibility. If your network is growing larger or more complex, you may need network monitoring and traffic analysis tools.
Peeking into the network
There are four main ways for tools to gather information from your network. We’ll illustrate these with screenshots from command line tools.
(1) Listening in (passive monitoring). The tool can watch packets passing by on the wire or through the air. For instance, windump (tcpdump) and the graphical tool WireShark collect and display packets passing by an interface.
(2) Sending out packets to see what happens (active monitoring). A tool can probe devices and hosts by sending customized packets to see what responds, and how. For instance, ping can show if a host is up and reachable; nmap will list all the live hosts on a network address range, and can discover many of their characteristics.
Figure 4: Querying via SNMP with snmpget
(4) Subscribing to ongoing summaries of activity and event notifications. Some devices (and hosts) have facilities that will observe events for you, and send you updates. You can configure such a device to send alerts over the network to a designated collector when certain events occur (eg via SNMP traps); and/or you can configure the device so that it rolls up metrics data and regularly pushes it to a designated collector (eg via NetFlow or sFlow).
What a smart tool can do for you
The information gathered by these methods is detailed and complex, and, unless your network is quite small, voluminous. Modern network monitoring and traffic analysis applications have built-in facilities for summarizing and interpreting the data, to provide automated assistance for many different tasks.
- Maintaining a network inventory. Auto-discovering the devices and hosts on your network helps you identify critical infrastructure and dependencies. A real-time map helps in spotting unauthorized devices and connections. And an up-to-date inventory provides data to your change control process.
- Displaying and exploring realtime network state. A smart tool can roll up and correlate the complex and voluminous information it receives to display the state of devices and traffic on your network in useful ways. A tool can show you which hosts, users, and applications are consuming the most bandwidth. It can highlight latency and communication issues. It can support exploration to diagnose and troubleshoot problems – sorting and filtering data, drilling down into the relevant details.
- Get automatic early warning of anomalies. It’s nice not to have to sit in front of the real-time display all day. Automated alerting can watch for known types of issues – failing or failed devices, misconfigured devices, spikes in usage, unstable routing tables, signs of security incidents, etc — and send you an alert.
- Roll up historical traffic data to show patterns and trends. Real time trends are important, but spotting long term patterns enables you to be proactive, to adapt and plan. Saving historical statistics and displaying patterns and trends provides the information necessary for adjusting QoS and traffic shaping, and gives early warnings as to the need for replacement hardware and upgrades.
Best free NetFlow analyzers and collectors
Below we look at the most popular and feature-rich NetFlow analyzers and collectors that are free on Windows. All are sophisticated, and have a considerable learning curve; so online training and good support are important.
SolarWinds produces a suite of products providing comprehensive support for network monitoring and management. The Real-Time NetFlow Traffic Analyzer is a free tool (download it here) that provides real-time insight into your current flows.
The free version focuses on displaying the current and recent state of your banwidth usage. It’s limited to one NetFlow interface and 60 minutes of data. Flow technologies supported include NetFlow, Juniper’s J-Flow, IPFIX, and Huawei’s netstream.
Figure 5: SolarWinds Real-Time Network Traffic Analyzer
The analyzer identifies which devices, apps, and users are consuming the most bandwidth. The user interface displays inbound and outbound traffic for the chosen NetFlow exporter; you can sort and display traffic in various ways. The tree explorer summarizes NetFlow traffic into applications, conversations, domains, endpoints, and protocols. You can expand each into an inclusive graph and drill down to examine particular aspects. The tree views and graphs all update in real time.
If you later move up to the non-free Network Traffic Analyzer, be aware that it integrates with SolarWind’s Network Performance Monitor, so you must accommodate the costs and platform requirements of both.
Installation of the free tool is via a standard windows setup wizard, and the NetFlowConfigurator is included to assist in configuring your devices that support various NetFlow variants.
If your key devices support NetFlow, and you’re looking for a lean and clear viewport into your current and recent bandwidth usage, the SolarWinds Real-Time Netflow Traffic Analyzer fits the bill.
2. Paessler PRTG Network Monitor
The Paessler PRTG Network Monitor is a “batteries included” solution that monitors bandwidth utilization, the availability and health of devices on your network, and more. PRTG can monitor multiple sites, WAN, VPN, and cloud services. The free version provides unlimited sensors for a month, and thereafter is limited to 100 sensors. Since a sensor is an individual data stream, each device will typically require several sensors.
Figure 6: PRTG device tree
In the user interface, a primary view is the device tree showing all devices on your network and the sensors monitoring each. Devices include firewalls, routers, access points, servers, workstations, virtual servers, storage, etc. The device tree is supplemented by table views of sensors, logs, and alarms, as well as various charts and graphs for bandwidth, etc. You can sort and filter the tables.
When you drill down through the tree view, it provides indicators and metrics at every level. Settings, like scan interval, are inherited, and you can override settings at lower levels in the device tree. You can also set alerts at every level. Thus you can arrange to be notified about events and threshold transitions of a particular critical device, or rolled up from an overall aspect of your network. Alerts can be transmitted in multiple ways, including SMTP email and SMS text messaging.
The devices-and-sensors abstraction shapes the dashboards and reports, too. You can create custom dashboards, including interactive maps. The tool comes with a range of predefined reports, and facilities for designing custom reports; you can also schedule reports.
Figure 7: PRTG NetFlow sensor
The traffic analysis facilities include built-in NetFlow support. For flow protocols, PRTG supports NetFlow, sFlow and J-Flow. Other protocols/mechanisms used include SNMP, WMI, and packet sniffing.
Installation is straightforward. There is a setup wizard, as well as a video providing step by step guidance. At installation, the core server’s local probe does auto-discovery to identify devices and set up sensors. You can add additional sensors (including NetFlow collectors) manually; a video provides instructions.
The core server is Windows only. You can monitor a single site via the web application (allowing remote web-based monitoring); but the simultaneous view of multiple core servers requires using the enterprise app on Windows. A mobile app is also provided. One clever addition is PRTG provides QR codes that you can print and paste on particular devices throughout your facility for quick lookup and statusing in the mobile app. PRTG supports clustering for fault tolerance: you can set up failover instances of the monitor.
Though PRTG is all-in-one so you don’t need multiple products and licenses to gain comprehensive monitoring, you should evaluate how many sensors your network needs, and accommodate the long-term cost of the sensor-based licensing model as you grow.
3. ManageEngine NetFlow Analyzer
The ManageEngine NetFlow Analyzer provides real-time visibility into network bandwidth and traffic patterns. The tool visualizes traffic by applications, conversations, protocols, etc. You can set alerts based on traffic thresholds. The analyzer comes with a variety of useful predefined reports, ranging from troubleshooting support to capacity planning and billing; and the tool has facilities for creating custom search reports.
Figure 8: ManageEngine dashboard
The NetFlow Analyzer has a suite of NetFlow-oriented tools for managing complex networks. The web-based user interface has a default dashboard with several real time pie charts, including a heat map showing status of monitored interfaces, top applications, top protocols, top conversations, recent alarms, top QoS, and more. Hovering in a graphic usually provides an explanatory pop-up, and clicking in a graphic drills down to more details on the selected element.
Figure 9: ManageEngine Alerts and security status
Alerts show up as pop-ups on the user interface. There are specific displays for detecting security issues. Dashboards are customizable. The tool supports analysis of multi-site traffic. There is a smartphone app for mobile monitoring and alerting.
Flow technologies supported include NetFlow, IPFIX, J-Flow, NetStream, and several others. The tool leverages advanced features of Cisco devices, including support for adjusting the traffic shaping and QoS policies on your network.
The ManageEngine Netflow Analyzer provides a range of capabilities for managing complex networks making heavy use of NetFlow. The free version allows unlimited monitoring for 30 days, but then reverts to monitoring only two interfaces. ManageEngine has a variety of related products to expand beyond NetFlow traffic oriented analysis into a full network management suite.
4. Nprobe and ntopng
ntopng is an open-source web-based traffic analysis tool that does passive network monitoring based on flow data and statistics extracted from observed traffic. ntopng does the packet capture itself; to receive flow data it depends on nProbe, a NetFlow/IPFIX exporter/collector. Flow protocols include NetFlow v9, IPFIX, and NetFlow-lite.
The community version of ntopng is free. The professional (small business) and enterprise versions require a paid license, but are free to educational and nonprofit organizations. nProbe can be test-driven for free but is limited to 25000 flows exported; a fully functioning version requires a paid license. This limits your ability to use NetFlow — unless you qualify for a free license!
Figure 10: ntopng flows
ntopng’s web-based user interface rolls up data into traffic (eg, top talkers), flows, hosts, devices, and interfaces. Most categories have multiple views — a mix of charts, tables, and graphs; and in each you can drill down to explore in depth and cross-reference. You can sort tables – for instance, selecting the throughput column on the flows table shows the current top bandwidth users.
Figure 11: ntopng host geolocation
The flow display shows application protocols (eg Facebook, YouTube), and can list latencies and TCP statistics (eg packet loss). ntopng can show observed hosts on a map via geolocation. You can set alerts on hosts based on many criteria; an alert shows up as an icon in the user interface.
The professional version can save and display historical application usage statistics, do active monitoring via SNMP, generate custom traffic reports, and several other additional features.
The installation package for both ntopng and nProbe is a zip file containing a standard Windows setup wizard. The installer will install winpcap (for packet sniffing) if needed.
Since ntopng is open source, there is considerable scope for extending it, and an open-source community working on doing that. ntopng can export data to MySQL, ElasticSearch, and LogStash.
Even simply looking at the free options for Windows, multiple excellent tools for network monitoring and traffic analysis are available. Your final choice depends on the size and complexity of your network, and how you expect it to evolve in the future.
“Monitor-Binary-Binary-System” by Geralt on Pixabay licensed under CC0.