NetFlow Reporting

I'm looking for a decent NetFlow reporting tool than can meet a very specific requirement, but so far I'm not finding what I want.

What I need to do is gather bandwidth utilization for an architecture that does not yet truly exist. What I have is an environment that currently houses all production services inside one data center at one location. The proposed environment is going to offsite many of the current production services. I need to figure out how much bandwidth will be required to maintain the communications between the servers going offsite, and the servers staying onsite.

The current NetFlow tools don't seem to allow me to group these devices logically, say Site A and Site B, and then report on only the traffic between Site A and Site B as a group. I'm not interested in micro details of individual server communications, but I am VERY interested in the aggregate communications between the two groups.

Has anyone come across a similar problem? Do any of you have any recommendations for tackling this problem outside of adding up several hundred individually detailed flows?

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

Zartanasaurus

What NetFlow tools have you used? I don't see anything in your requirements that would keep flow-tools from giving you what you need.

Forsaken_GA

flow tools commandline tools should be able to generate the reports you want. I believe nfsen will also do the logical groupings you're looking for, though be forewarned, that nfsen's documentation is atrocious.

cisco_trooper

I have actually just been introduced to flow tools when reading the "Network Flow Analysis" book you have in your signature. I haven't gotten too far through it yet. I am hoping it will do what I want without too much trouble. I have had nfsen on my list of crap to do for a while now, but just haven't been able to get to it.

jakemichaelwilson

Regarding "aggregate communications between the two groups". What if the NetFlow tool let you add multiple routers into the same report and then let you filter for all traffic from this subnet(s) to this subnet(s)? Would this help you? I tested this using Scrutinizer from plixer and it worked fine.