As Network engineers and Administrators, many of us are consistently dealing with issues that aren't always as apparent as they seem. This where analyzing network traffic comes in handy. So the question then comes what is NetFlow and what are Network Analyzers?
NetFlow Analyzers and Collectors are very useful tools to assist in monitoring and analyzing network traffic data to help you manage these issues and potentially stop them before they become major problems. NetFlow analyzers allow you to pinpoint machines and devices that are hogging bandwidth, to find bottlenecks in your system, and, ultimately, to improve your network’s overall efficiency.
The term “NetFlow” refers to a Cisco proprietary protocol for collecting information about IP traffic and for monitoring network traffic; NetFlow has become the industry standard protocol for flow technologies. NetFlow software collects and analyzes this flow data generated by routers, and presents it in a user-friendly format.
A few other network vendors have their own protocols for network traffic data monitoring and collecting. For example Juniper, another highly respected network device vendor, calls their protocol “J-Flow.” HP and Fortinet use “sFlow” standard which we've covered here. Even though Flow data has different names, they all provide mostly the same information and work in similar ways. There are many analyzers and collectors available, and in this article, we will discuss 10 commercial and free NetFlow analyzers and collectors available for Windows.
Most of the NetFlow software vendors listed below have instructions on how to enable NetFlow on various manufacturer’s devices. Your device manufacturer’s documentation should also have this information.
SolarWinds Real-Time NetFlow Traffic Analyzer – Get it HERE
The Free NetFlow Traffic Analyzer from SolarWinds is one of the more popular tools available to download free. This tool allows you to sort, graph, and display data in various ways that allow you to visualize and analyze your network traffic. It is great for tasks such as seeing network traffic by type and for specified periods of time, and running tests to see how much bandwidth various applications consume.
This free tool limits you to one NetFlow interface monitoring and keeps only 60 minutes of data. This Netflow Analyzer from SolarWinds is a powerful tool that is definitely worth the download.
Colasoft Capsa Free
This freeware network analyzer from Colasoft allows you to identify and monitor specific protocols — it supports over 300 network protocols — and create customizable reports. It includes email monitoring and a TCP timing sequence chart, all combined into you own customized dashboard.
Other features include network security analysis, such as DoS/DDoS attack, worm activity, and ARP attack detection; packet decoding and information display; statistics on each host on network; and conversation monitoring and packet stream reconstruction. Capsa Free supports all 32bit and 64bit versions of Windows XP, with a minimum of 2GB RAM and 2.8GHz CPU. You will need NDIS 3 or higher compatible Ethernet, Fast Ethernet, or Gigabit with promiscuous mode driver- this mode lets it passively capture all packets on an Ethernet wire.
Angry IP Scanner
Angry IP Scanner is a lightweight, open-source network scanner that is fast and easy to use. It does not require installation and can be used with Linux, Windows, and Mac OSX. It operates by simply pinging each IP address and can resolve hostname, determine MAC address, scan ports, provide NetBIOS information, determine logged-in user on Windows systems, web server detection, and more. Its capabilities can be expanded with Java plugins. Data from scans can be saved to CSV, TXT, XML or IP-Port files. A very useful, portable network scanner.
ManageEngine NetFlow Analyzer Professional
This is ManageEngines’s full-featured version of their NetFlow software. It is a powerful piece of software, with a full range of analysis and collection capabilities. They include real-time bandwidth monitoring and threshold alarms for set bandwidth usage, usage summaries, application and protocol monitoring, and much more. The free version includes 30-days of unlimited monitoring, and after that it allows for monitoring of only two interfaces.
System requirements for ManageEngine’s NetFlow Analyzer depend on the flow rate. At a minimum, for a flow rate of 0 to 3000 flows per second, the recommended requirements are a 2.4GHz Dual Core CPU with 2GB RAM and 250GB of hard-disk space. The requirements go up as you increase the flow rate you wish to capture.
Despite a name that brings images of someone sitting on the beach, avoiding work of any sort, and completely out of touch with the world, this application is, in fact, a popular and useful network monitor developed by MikroTik.
It automatically scans all devices and draws a map of the network. It monitors servers running on devices and alerts you in case of a problem. Other features include auto-discovery and mapping of new devices, the ability for you to draw your own maps, provides you access to tools to remotely manage your devices, and more. It runs on Windows, Linux Wine, and MacOS Darwine.
JDSU Network Analyzer Fast Ethernet
A powerful, yet easy to use, application, JDSU Network Analyzer Fast Ethernet allows anyone of any skill level to quickly collect and view data from their network. It lets you view logged-on users, identify bandwidth usage by machine and user, promptly locate and troubleshoot errors before they become major problems, and gives you the ability to do live data capture and analysis. The application includes the capability to create highly detailed graphs and tables that let administrators view traffic anomalies, data filtering to help sift through the large amounts of data, and much, much more.
You can view all of JDSU Network Analyzer Software’s features and technical overview here. A tool for the entry-level network technician as well as the hardened administrator, JDSU allows you to fully take control of your network.
This full-featured traffic analysis tool provides you with the ability to comprehensively capture and analyze your network traffic and to find and stop errors quickly and efficiently. With Scrutinizer, you can filter and drill down in nearly any way you can imagine, including time frame, host, application, protocol, and much more.
The free version allows you to monitor an unlimited amount of interfaces and store up to 24 hours of data.
Wireshark is a powerful network analyzer with features that rival other free or paid services. It is cross-platform and can run on Linux, Windows, MacOS X, Solaris, and other platforms. Wireshark lets you view captured data via a GUI, or you can use the TTY-mode TShark utility.
Its features include capture and analysis of VoIP traffic, show live data from Ethernet, IEEE 802.11, Bluetooth, USB, Frame Relay, and others, output data to XML, PostScript, CSV, or plain text, decryption support, and much more. System requirements include Windows XP and up, any modern 64/32bit processor, 400MB available RAM, and 300MB disk space. Wireshark NetFlow Analyzer is a powerful, must-have tool for any network administrator’s toolkit.
PRTG by Paessler provides many useful features. It includes support for monitoring LAN, WAN, VPN, as well as application, virtual server, QoS, and environmental monitoring. It comes with the capability to do Multiple Site Monitoring.
PRTG uses SNMP, WMI, NetFlow, sFlow, jFlow, and Packet Sniffing to monitor Bandwidth, along with uptime/downtime monitoring and IPv6 support. The Freeware version gives you 30 days of unlimited sensors, then 100 sensors free after that.
nProbe by ntop is a full-featured open-source NetFlow capture and analysis application. Although it may not have as many of the visual bells-and-whistles like those of other applications on this list, that does not mean it is lacking in any features or capabilities.
Some of these include support for IPv4 and IPv6, Cisco NetFlow v9/IPFIX, NetFlow-Lite support, VoIP traffic analysis, flow and packet sampling, generating logs of web, MySQL/Oracle and DNS activity, and many more features. The software is free if you download and compile on Linux or Windows (http://packages.ntop.org/).
The executable binary installation file limits data capture to 2000 packets. (It is completely free for universities, education users, and non-profit and research organizations.) nProbe will run on Linux and Windows 64bit OS platforms.
This comprehensive list of 10 free NetFlow analyzers and collectors should give you the ability to quickly begin monitoring and troubleshooting your network, from a small office LAN to a large, multi-site enterprise WAN. (Locate instructions on how to enable NetFlow for your respective devices within the documentation for the application you choose, or if not there, then on the manufacturer’s website.) If your looking for an open-source variation, see our list of some here.
Each application gives you the ability to monitor and analyze traffic on your network, key to finding small errors before they turn into big ones, pinpoint bandwidth anomalies that can be indicative of security threats, visualize your network and its traffic flow, and much, much more. What you can do with the data these Network Analyzers give you is limitless. A must-have piece of software for all network administrators.
Top 10 Free Netflow Analyzers Rated and Reviewed - The winner takes all!