Thursday, February 23, 2006

Ntop with Netflow v 5

I need sometools to monitor my LAN. At first, i used Ntop with port span. Bad thing about this, my ntop server's cpu, seemed like in the middle of processing/cracking 2048 RSA/3DES/Blowjobfish encryption. SO decided to enable netflow plugins in ntop. It's only need 3 steps to enable netflow on cisco router.

1) Select which interface to enable netflow
2) point netflow to listener ip
3) define version of netflow. walla..

(config)#conf t
(config)#int fa 0/0
(config-if)# ip route-cache flow
(config-if)#exit
(config)#ip flow-export destination 1.1.1.1 9995
(config)#ip flow-export version 5
(config)#exit

To test netflow configuration #show ip flow export

Theb run the ntop.

#ntop -d -s -b -w 1.1.1.1:68532

Since i have multiple router/switches, i need to listen for multiple netflow traffic. I need to config netflow plugin to listen on multiple port.So, defining another port in netflow configuration for different switch will do the tricks.

By the way, ntop is a very nice tool written by Luca Deri. If you're looking for netflow solution and happen to have extra money, go and buy this tool => nbox

No comments: