Has anyone had success with the (free tier) ManageEngine NetFlow Analyzer?
- With netflow enabled, I tried nprobe on the ER-X and ntopng (on a collector host). This looked nice but it only saw a fraction of traffic, plus I didn't like running the precompiled, closed-source nprobe on the ER-X (which crashed silently a number of times).
- I then switched to sflow:
flow-accounting { ingress-capture post-dnat interface eth0 sflow { agent-address 10.250.110.1 server 10.250.110.6 { } } }
and installed SFlowTrend. This worked fine (stable) but SFlowTrend isn't nearly as slick and the free tier does not store history past 5 hours. For all the trouble, it doesn't really add much over what's built into the latest EdgeRouter firmware.
- So I killed it and on the same collector host installed ManageEngine NetFlow Analyzer. This looks slick at first glance but it doesn't see any sflow packets. The UDP port ist listening according to netstat:
udp 0 0 0.0.0.0:6343 0.0.0.0:*
The packets get there too as shown by tcpdump:
19:40:09.532189 IP (tos 0x0, ttl 64, id 21644, offset 0, flags [DF], proto UDP (17), length 1344) 10.250.110.1.45100 > 10.250.110.6.6343: sFlowv5, IPv4 agent 10.250.110.1, agent-id 0, seqnum 1255001, uptime 84558000, samples 7, length 1316 flow sample (1), length 176, seqnum 8742080, type 0, idx 1, rate 1, pool 8742080, drops 0, input 2 output 4 records 3 enterprise 0 Extended Switch data (1001) length 16 src vlan 0, src pri 0, dst vlan 0, dst pri 0 enterprise 8800 Unknown (2) length 8 enterprise 0 Raw packet (1) length 96 protocol Ethernet (1), length 82, stripped bytes 4, header_size 78 flow sample (1), length 176, seqnum 8742081, type 0, idx 1, rate 1, pool 8742081, drops 0, input 2 output 4 records 3 enterprise 0 Extended Switch data (1001) length 16 src vlan 0, src pri 0, dst vlan 0, dst pri 0 enterprise 8800 Unknown (2) length 8 enterprise 0 Raw packet (1) length 96 protocol Ethernet (1), length 82, stripped bytes 4, header_size 78 [...]
Does anyone have ManageEngine (Zoho) NetFlow Analyzer working and would you be willing to share the specifics?
I might try their forum but it's a very lonely, semi-non-technical place so I don't expect much.
I'm not sure what other (free) alternatives I have as I'm not running WIndows (I think I'd like PRTG...).
Thanks!
Robert