netflow and cacti

Guest · Post by **Guest** » Fri Nov 15, 2002 7:24 am

Does anyone know of a module, which can analyse netflow files (e.g. from flow-tools) and process the data for cacti?

wesphillips · Post by **wesphillips** » Fri Apr 18, 2003 4:08 pm

I am using flowscan. It takes the output files from flow-tools nad parses through the data and creates rrd files for you. All you ahve to do is create an inactive data source that points to the rrd and create a graph based on that DS.

go to
http://net.doit.wisc.edu/~plonka/FlowScan/

kbowerman · Post by **kbowerman** » Mon Oct 20, 2003 8:34 pm

All you ahve to do is create an inactive data source that points to the rrd and create a graph based on that DS.

Pardon my ignorance but I don't understand how to do this.

olavl · Post by **olavl** » Wed Mar 24, 2004 7:00 am

Very off topic, since this is not Cacti related at all. But here is some netflow, flow-tools and flowscan info:
http://www.caida.org/tools/utilities/flowscan/
http://www.linuxgeek.org/netflow-howto.php
http://www.ncne.org/training/techs/2002 ... cument.htm
http://netflowguide.com/?page=guide

flow-tools is a software package with tools for capturing and extracting information from netflow, flow-scan is a module for graphing netflow captures.

CaM · Post by **CaM** » Thu May 11, 2006 2:30 pm

I understand there is a large gap between my post and the last but thought I'd pop it on anyways

I just got CactiEZ Beta CD from http://cactiusers.org/forums/topic281.html

After installing it I noticed the clever ones had already configured everything including flow-tools at which point I found "FlowViewer" at http://ensight.eos.nasa.gov/FlowViewer/

Once installed and configured for our setup I added http link into cacti using the ntop plugin.

Nice as it allows me to answer who/what was actualuy causing the graphs to peak at 3am in the morning! nice!

What a tool cacti is eh! well chuft with it!

knobdy · Post by **knobdy** » Wed May 24, 2006 11:56 am

CaM wrote: Once installed and configured for our setup I added http link into cacti using the ntop plugin.

What do you mean by this, just a link to the pages created by FlowViewer?

cigamit · Post by **cigamit** » Wed May 24, 2006 8:25 pm

CaM wrote:After installing it I noticed the clever ones had already configured everything including flow-tools at which point I found "FlowViewer" at http://ensight.eos.nasa.gov/FlowViewer/

Once installed and configured for our setup I added http link into cacti using the ntop plugin.

I'm currently in the progress of rewriting FlowViewer from perl to pure PHP (60% done, just finishing up the backend work), with a slightly prettier interface and ofcourse Cacti integration via a plugin. Do you happen to use the FlowGraph also? As I don't really see too much use for it, and not sure I want to take the time to convert it if no one else is going to use it.

CaM · Post by **CaM** » Thu May 25, 2006 1:31 am

knobdy: Yep just using the url link from the NTOP plugin. Maybe other plugins around to do it but was quick and dirty way to show the boss.

cigamit: that sounds good. nah dont use the flowgrpah! like you say not much use for it. If you want me to do any testing then give us a shout....

knobdy · Post by **knobdy** » Thu May 25, 2006 4:56 pm

Yeah, and post it soon!

cigamit · Post by **cigamit** » Thu May 25, 2006 6:41 pm

knobdy wrote:Yeah, and post it soon!

You can now find a mostly complete version of it up on my website. There are a few options to configure under Settings >> Path. You will also have to give yourself permissions ofcourse.

Only main thing left to do is get the DNS working, and add support for different devices. I also need to add the output to a file option. The default settings should work for anyone running the CactiEZ CD.

There may be a few errors, as I finished it up at 1am last night, let me know if you spot any. You will probably notice a few enhancements over the old perl version, like a little bit of javascript, and a single page view instead of multiple, and ofcourse the slightly nicer interface.

qwertz · Post by **qwertz** » Mon May 29, 2006 4:25 pm

Where can we find your webiste?

Thanks

QWertz

cigamit · Post by **cigamit** » Mon May 29, 2006 5:28 pm

qwertz wrote:Where can we find your webiste?

Thanks

QWertz

Via my sig....

Or here
http://cactiusers.org

qwertz · Post by **qwertz** » Wed May 31, 2006 3:43 am

Thanks i didin't know that it was your webserver

cigamit · Post by **cigamit** » Wed May 31, 2006 11:38 pm

BTW, updated it tonight. Now it adds DNS Support to the reports. It implements a local caching of IP addresses to a MySQL Table that only resides in memory (HEAP) so its really fast. You will want to set the DNS server, under the "Misc" settings though. Cleans out any stale DNS entries after 1 hour.

Next I will add the abilty to "Save" a report/query so that it can be ran again (an issue with the times is the only thing I have to work out), which leads me to the next feature. Running those saved reports on a schedule and then emailing them.

I also plan on adding "Save to File" support, which should be fairly simple.

CaM · Post by **CaM** » Thu Jun 01, 2006 5:45 pm

Hey cigamit!

well after thinking about my previous post I realised you was the clever one who built CactiEZ CD. All I can say is a very big thankyou and I will try my hardest to make my firm aware of yours and your counterparts excellence and donate enough to such a worthy tool and the whole open source community! my firm are beginning to see that we can no longer overlook Open Source solutions.

Again a big thankyou. I hope to PM you soon with some good news....

flowview - again thanks, it works a treat however I was wondering. I work for a international law firm with 12 offices and a fair amount of windows based server. The netflow data is being collected from routers mostly across 2Mb leased lines and a lot of data is hitting CactiEZ flow-tools hence my reason to move Cacti on to one box and move flow-tools off my main cacti server onto its own. Personally I use flowviewer as a web page on a CactiEZ box and link to it from my main Cacti server (windows 2003 Srv, Apache).

The flowview plugin works a treat on the CactiEZ box but would be nice if I could achieve the same from your plugin.

Is it acheivable to have the Flow Tools Binary Path, Flow Tools Work Directory etc. on a remote host.

reading this back to myself I realise i waffle alot......sorry!

netflow and cacti

netflow and cacti

Who is online