About Us  |  Services  | Recruitment  |  Advertise  | Contact

 

Computer Network Defence Ltd

IDS & IPS Products
Scanning Products
VPN & Firewall Products
Forensics Solutions
Content Protection
Training Courses
Raw Packets
Full Packet Capture
Protocol Analyzers
NetFlow Collectors
NetFlow Analyzers
Link Layer Headers
IP Frame
IPV6 Frame Headers
TCP Frame
UDP Frame
ICMP Frame
DNS Frame
ARP Frame
DHCP Frame
FDDI Frame
ASCII Codes
Network Classes
Dec Hex Oct Bin
MTUs
Encapsulation
HTTP Error Codes
Bug Sweeping / TSCM
Miscellaneous
Services


Network Flow Analyzers

Any device that monitors the network traffic between two or more connected computer systems. By examining the flow of traffic, Network flow analysers can be used to find out where problems (such as bottlenecks/congestion or the failure of a network device) are on a LAN. Advanced network flow analysers can also provide statistics on the traffic that can help to identify trends that may in future lead to further problems with the network.



 

NetFlow Analyzer 4

 

Manage Engine

http://manageengine.adventnet.com

ManageEngine NetFlow Analyzer is a web-based bandwidth monitoring tool that uses Cisco® NetFlow to help IT understand bandwidth usage in their network. Gathering NetFlow information exported from various devices, NetFlow Analyzer lets you see what applications are using bandwidth, who is using them, and for how long. With NetFlow Analyzer you can answer critical questions on bandwidth usage.With NetFlow Analyzer you can identify the exact reasons for network congestion and drill down to see what caused it. This information helps to solve most of the common day-to-day problems of bandwidth management, do better capacity planning, and increase the ROI on expensive network infrastructure.

Commercial

 

Information updated: 18 Jul 05


                                   CISCO IOS NetFlow

                                                                                   

Cisco

http://www.cisco.com/

Cisco IOS NetFlow efficiently provides a key set of services for IP applications, including network traffic accounting, usage-based network billing, network planning, security, Denial of Service monitoring capabilities, and network monitoring. NetFlow provides valuable information about network users and applications, peak usage times, and traffic routing. Cisco invented NetFlow and is the leader in IP traffic flow technology.

Commercial

 

Information updated: 21 May 05


StealthWatch

 

Lancope

http://www.lancope.com/

The StealthWatch sensor appliance provides fast, accurate monitoring for unexpected or unauthorized network behavior. Using flow-based architecture it provides continuous, real-time network traffic monitoring and instant identification of attack

Commercial

 

Information updated: 18 Jul 05

 


InMon Traffic Server

 

InMon

http://www.inmon.com

Managing today's large, high-speed networks brings unique challenges, combining the problems of managing L2 switched networks with the complexity of routing and BGP peering. In order to provide cost-effective, uninterrupted, high-performance network services, it must be possible to respond to real-time congestion and quality of service issues, defend against security threats, generate revenue from value-added service usage, and plan for future resource deployment. Visibility into current and historical traffic patterns across the entire network makes this possible.

Commercial

 

Information updated: 18 Jul 05   


Cflowd

 

Caida

http://www.caida.org

Flow analysis tool for analyzing Cisco's NetFlow enabled switching method. Permits data collection and analysis by ISPs and network engineers in support of capacity planning, trends analysis, and workload characterization in a network service provider environment. Also useful for tracking Web hosting, accounting and billing, network planning and anlalysis, network monitoring, developing user profiles, data warehousing and mining, as well as security-related investigations.

Free

 

Information updated: 18 Jul 05


NetMRI

NetCordia

http://www.netcordia.com

The NetMRI Network Analysis Appliance installs in minutes, requiring operators to enter only basic information about the network. At the heart of NetMRI's analysis process are a set of Expert Rules that detect problems associated with the correctness and stability of the network. NetMRI's Expert Rules are based on the best network practices developed by the Netcordia team's extensive network analysis experience.
There are three NetMRI™ models designed to support different size networks:
Campus Model portable, 8 lb desktop unit that supports up to 200 routers and switches or up to 5,000 router and switch interfaces.
Enterprise 500 Model dual-processor, 1U rackmount server that supports up to 500 routers and switches or up to 15,000 router and switch interfaces.
Enterprise 1000 Model dual-processor, 1U rackmount server that supports up to 1000 routers and switches or up to 30,000 router and switch interfaces.

Commercial

Information updated: 18 Jul 05


 Performance Guard

 

Premier Tech

http://www.premitech.com

The Network Analysis Module is layered on top of Performance Guard™ - a standard, off-the-shelf solution that provides the ability to monitor end-user quality of service by delivering consistent, accurate measurement of application performance from the end-user perspective in real time. The Network Analysis Module takes Performance Guard™ capabilities to the next level by performing trace route measurements from any client to any server in the network, immediately identifying response time and latency issues that may exist in the network, firewall or router.

Commercial

 

Information updated: 18 Jul 05


Sawmill

 

Sawmill

http://www.sawmill.net

Sawmill is a powerful, hierarchical log analysis tool that runs on every major platform. It is particularly well suited to web server logs, but can process almost any log. The reports that Sawmill generates are hierarchical, attractive, and heavily cross-linked for easy navigation. Complete documentation is built directly into the program.
Sawmill runs on all major platforms. Sawmill supports 600 log formats http://www.sawmill.net/features.html#10 (including Cisco NetFlow
 http://www.sawmill.net/formats/Cisco_NetFlow.html).

Commercial

 

Information updated: 18 Jul 05

Click Here To Go To The Top Of The Page

  Netflow Monitor

 

 

http://netflow.cesnet.cz/

NetFlow provides nearly real-time traffic monitoring, smart flow filtration, aggregation and statistic evaluation, multicriterial data flow selection, using source/destination IP addresses, protocols, etc. The NetFlow Analyzer should be able to deal with suspicious network activities (e.g. security attacks, routing troubles etc).

Free

 

Information updated: 18 Jul 05


Flow-Tools

 

Splintered

http://www.splintered.net

Flow-tools is a software package for collecting and processing NetFlow data from Cisco and Juniper routers.

Free

 

Information updated: 18 Jul 05


NetFlow Analyzer

 

Koonet

http://www.koonet.net

ManageEngine NetFlow Analyzer is a web-based bandwidth monitoring tool that uses Cisco® NetFlow to help IT understand bandwidth usage in their network. Gathering NetFlow information exported from various devices, NetFlow Analyzer lets you see what applications are using bandwidth, who is using them, and for how long.

Commercial

 

Information updated: 18 Jul 05

Click Here To Go To The Top Of The Page

NetFlow Tracker

 

Crannog

http://www.crannog-software.com

NetFlow Tracker is used to capture full NetFlow / IPFIX traffic information, allowing significant in-depth application and protocol information analysis to take place including user, server and applications activity. Traffic views by user, user group, conversation, system and application are available.

Key Benefits
* All the network, all the records, all the fields - all the time
* NetFlow built-in to most Cisco routers and managed switches and easily enabled
* All data conversations captured with per-minute resolution
* Data storage and archiving up to 999 years
* Delivers unmatched network forensics, troubleshooting and reporting capabilities
* Multicast Support
* Detailed network traffic visibility without probes or appliances
* Traffic identification by deep packet inspection
* Critical tool for today’s VOIP/IP Telephony and MPLS deployments

Commercial

 

Information updated: 22 June 07


  NetFlow Tools

 

Crannog

http://www.crannogsales.com

NetFlow, originally developed by Cisco and now an IEFT standard, is a routing accounting technology embedded in Cisco and other router vendor systems. It provides a rich set of traffic statistics for inbound traffic (both transit and traffic destined for a router). It is supported on Cisco routers from the 1400 upwards.

Commercial

 

Information updated: 18 Jul 05


  Orion Netflow Traffic Analyzer

 

Solarwinds

http://www.solarwinds.net

Orion NetFlow Traffic Analyzer provides a new level of visibility into network traffic behavior and trends. Network engineers are now able to analyze the full breadth and depth of network traffic, including the most global view of bandwidth consumption, as well as the most local view of current, detailed data measured directly from the devices that create and route the traffic.

By leveraging Cisco's NetFlow protocol to extract data from routers, NetFlow Traffic Analyzer provides an in-depth view into which users and which applications are consuming the most bandwidth. NetFlow Traffic Analyzer converts that data into charts and tables providing network engineers with an easy way to identify and isolate the cause and source of network problems, as well as provide historical performance information to help plan for future growth. Pie charts show the distribution of bandwidth across different types of traffic (e.g., HTTP, FTP, VoIP) and across different users. Line charts show the usage patterns over time. NetFlow Traffic Analyzer can also identify the source of external traffic inbound to the corporate network.

Network engineers rely on NetFlow Traffic Analyzer to help ease day-to-day pains caused by the inability to drill down into network traffic data statistics. Orion NetFlow Traffic Analyzer:
* Optimizes network resource allocation
* Enables quick troubleshooting of network problems
* Profiles users' consumption patterns
* Profiles applications' consumption patterns
* Enables quick access to traffic data
* Minimizes storage costs
* Scales to monitor interfaces with multi-gigabit throughput
* Enables long-term storage of NetFlow data
* Improves performance & availability

Commercial

 

Information updated: 09 Nov 06

Click Here To Go To The Top Of The Page

  Scrutinizer NetFlow & sFlow Analyzer

 

Plixer International

http://www.plixer.com

Who, What, When and Where: Scrutinizer provides historical trends of the company's critical network interfaces as well as the details on:
Who: The end system causing the traffic
What: The application/protocol that is being used
When: The time frame it has been occurring for
here: The network connection that is affected

Result: If something is consuming excessive bandwidth the end system can be identified quickly, without utilizing a packet analyzer.

Scrutinizer uses your existing NetFlow capable routers and switches to report on top applications and top hosts on specific interfaces. It provides details on how much bandwidth is being consumed by each of these variables from protocols per user to users per protocol. Because Scrutinizer uses NetFlow technology on your existing routers, you never have to deploy or maintain probes. Scrutinizer goes beyond simple utilization graphs and tools like MRTG.

Commercial

 

Information updated: 20 June 07


  Arbor Networks PeakFlow X

 

Arbor Networks

http://www.arbornetworks.com

Arbor Networks' Peakflow X security platform was purpose-built to meet the demands of the largest enterprises, addressing a wide range of external and internal security threats while maintaining business continuity. It constructs a system-wide view of the entire network, auto-learning host behaviors to determine who talks to whom, and how.

Proactively Manage External and Internal Threats - Using this data in conjunction with real-time security information provided through Arbor's subscription-based Active Threat Feed (ATF), Arbor Peakflow X generates actionable insight, allowing IT organizations to:
* Gain unmatched network visibility
* Stop known and emerging threats such as distributed denial of service (DDoS) attacks, viruses, botnet army attacks and worm outbreaks
* Determine if application performance anomalies are causing network performance problems
* Track down and eradicate phishing solicitations
* Harden the internal network against future threats
* Control user access and eliminate insider misuse.

Network Behavior Analysis (NBA): The Key to Beating Zero-Day Attacks - Arbor Peakflow X quantifies normal network behavior, analyzing flow statistics such as Cisco Systems' NetFlow, Juniper Networks' cFlow, sFlow from Extreme Networks and Foundry Networks devices, and raw packet data. It uses this information to create baseline definitions of normal network behavior.

In real-time, Arbor Peakflow compares traffic against these baselines to perform network behavior analysis (NBA), an innovative management technique used to identify developing security threats that do not yet have signatures - and therefore may easily slip by other devices such as intrusion prevention systems and firewalls - including virulent "zero day" attacks.

Also see the Service Provider version - PeakFlow SP

Commercial

 

Information updated: 20 June 07


Further Information

 

Links to more information

 

http://www.sans.org/rr/whitepapers/commerical/778.php
http://www.faqs.org/rfcs/rfc3176.html
http://www.sflow.org/
http://www.sflow.org/products/network.php

 

 

Information updated: 18 Jul 05


List of Vendors that Export to NetFlow & Sflow

Export to NetFlow

Export to Sflow
Cisco http://www.cisco.com
Enterasys http://enterasys.com
Extreme Networks http://www.extremenetworks.com
Foundry Networks http://www.foundrynet.com
Juniper Networks http://www.juniper.net
Riverstone Networks http://www.riverstonenetworks.com
Extreme Netwoks http://www.extremenetworks.com
Force 10 Networks http://www.force10networks.com
Foundry Networks http://www.foundrynet.com
Hewlett-Packard http://www.hp.com/rnd/index.htm
Hitachi http://www.hitachi.com
InMon Corp. http://www.inmon.com
Ntop.org http://www.ntop.org/ntop.html

 

 

Information updated: 18 Jul 05

Click Here To Go To The Top Of The Page

Last page update: 06 Sep 2007

Computer Network Defence Ltd
Information Security Consultancy and Recruiting
enquiries@securitywizardry.com 

Copyright © 2004 Computer Network Defence Ltd. All Rights Reserved.

PO Box 2680, Corsham, Wiltshire, SN13 0ZR, UK
Phone       0870 3219014
International +44 (0) 1225 811806