NetFlow Reporting – You Get What You Pay For
Are you in the market for a NetFlow Analyzer?
Get ready to peer into one of the most competitive markets in the traffic analysis arena.
Prices range on average from over $100,000 to under $1,000.
How do you know which product is right for you?
What Is NetFlow
NetFlow is a technology developed by Cisco Systems that is also supported by many other hardware vendors.
NetFlow is far easier to setup and use than other network traffic monitoring technologies that require the deployment of distributed hardware probes.
Basically, the router or switch is setup to summarize every conversation incoming on each network interface and then forwards it onto a NetFlow collector, where the details are compiled and displayed in an easy to understand format.
High-End Vendors
The high end vendors such as NetQoS, Arbor, Mazu and Lancope justify their high prices by outlining ROIs which are reinforced by selling potential threat awareness.
These vendors tout support for distributed collectors and capacity for tens of thousands of flows per second.
They usually include NBA (aka Network Behavior Analysis) features which resemble an IDS (aka Intrusion Detection Systems) with deduplication.
The entry point with these vendors generally starts at about $30,000.
 "You can buy an inexpensive but feature / performance limited Hyundai or you can buy a high performance, feature-rich BMW. Lancope sells the BMW of NetFlow analysis platforms," said Adam Powers - chief technology officer of Lancope. |
"In short, there are two fundamental differences between technologies such as Plixer, Crannog, or AdventNet and high-end NetFlow technologies from the likes of Lancope:"
"1. Performance and scalability"
"2. Behavior-based flow analysis technology."
Low-End Vendors
Low-end vendors such as ManageEngine, Crannog and Plixer have basic alarming capabilities but, lack the NBA features of the high-end solutions.
Some of these tools claim the same NetFlow volume abilities, however, thorough testing should be done in lieu of believing claims from any vendor on capacity.
In point of fact, many companies with 50-200 routers are producing less than 6000 flows per second (i.e. about 200 NetFlow packets/second).
And, these less expensive flow analyzers have arguably equally intuitive reporting front ends.
The entry point starts below $1,000.00.
 "Probably 90% of the time network analysts are using their NetFlow reporting tools to follow up on questions related to performance, not false alarms." |
"However, we do see a need for advanced alarming and Network Behavior Analysis is being developed for a Q1 2008 release," said Plixer president - Mike Patterson.
How To Decide
When considering NetFlow analysis tools, know your budget and try to outline what is important to you before you go looking.
 |
Top utilized interfaces for the past 5 minutes, 30 minutes, etc. |
|
|
Network Behavioral Analysis or Simple threshold Notifications with Syslog capabilities. |
|
|
QoS (ToS & DiffServ) reporting – important for VoIP. |
|
|
Autonomous System reporting. |
|
|
How is data archived and retrieved over time. |
|
|
Network diagramming and mapping. |
|
|
Scheduled emailed reports and support for the PDF format. |
|
|
The ability to handle up to 5,000 flows per second or over 10,000. |
|
|
Custom Reports or filters with the ability to include or exclude data. |
|
|
NetFlow v5,7, & 9 support as well as IPFIX and sFlow v2,4 & 5. |
|
|
SNMP v1v2 & v3 support. |
|
|
Ability to integrate with 3rd party tools (HPOV, Orion, WhatsUp Gold, etc.) |
Tell the vendors what features you liked about the other products and listen to how they respond.
Always request an online a demonstration of the product and get prices of what it would cost to support your infrastructure with the vendors software on a yearly basis.
If you like what you see and hear, request an evaluation and call support often to test their responsiveness.
How Will It End
It will be interesting to see how the hper-cometitive NetFlow industry will settle.
The very first digital watches were expensive as well and that certainly changed.
Remember how cheesy and unreliable the first Japanese cars were?
Today we don’t see many Toyota owners trading in their cars for a Chevy.
Then again, remember the Yugo?
Related Stories:
Brad Reese cofounded BradReese.Com Cisco Refurbished, which enables affordable networks globally by assuring customer satisfaction with guaranteed one year warranties on both Cisco Repair as well as Refurbished Cisco.
Don't be shy, contact Brad Reese online or call him Toll Free:
866-864-0506
International callers may wish to call Brad by dialing:
850-364-4115
The Leader in Network Knowledge
