wvnetflow.sourceforge.netWebview Netflow Reporter download SourceForgenet

Table of contents Overview Download New in 2013 Key features Custom traffic categorization Graphs and Table reports Clickable graphs Ad hoc query tool Netflow exporter and interface discovery and normalization Flexible data aggregation Netflow-embedded timestamps Industrial-strength flow collection and exporter manangement Open source Uses of this application that may not be immediately apparent Quality-of-Service (QoS) Security forensics Profiling WAN acceleration (WAAS, WAFS, etc) Capacity planning Tracking IT migrations Route monitoring Limitations and comparison with other packages System Requirements History and author Overview is an enterprise-focused Netflow reporter/analyzer tool featuring clickable graphs, powerful categorization that goes beyond simple TCP/UDP port names, automatic exporter discovery, and full access to all aspects of the raw flow data (interface names, millisecond accuracy, QoS settings, TCP flags, etc). Webview installs on a Linux is accessed via a web browser. In a typical setup, Netflow data is constantly categorized and tracked on each router/switch interface. The web user selects one or more interfaces and can view a graph of average or/or peak traffic utilization for each category over the past hour, day, week, etc (see sample screenshots below). The user can also run ad hoc reports over any time period to explore all aspects of the traffic, such as a top talkers IP address report or a raw flow chronology. Download Download the latest version Sourceforge.net project site with release details, mailing list, all files, wiki, etc. Quick installation scripts INSTALL.ubuntu tested with Ubuntu 12.0.4 INSTALL.centos tested with CentOS 6.3 New features in 2013 (version wvnetflow-1.07) Connection reporting. A "connection" is a complete TCP/UDP session, which may span many flows. Connection reporting clearly identifies the client (initiator) and the server, and also reports on bidirectional packets/bytes transmit/receieved, etc. By looking at a connection as it crosses multiple routers, it is easy to identify packet loss, asymmetric routing, and other oddities. See Ad hoc query tool for more details. Built-in Symmetric Multiprocessing (SMP). This improves performance on multi-core CPU's when there are many exporters. SNMPv3 support Powerful reporting on the health of flow collection , including out-of-order and duplicate exporter packets. rrdcached is now fully supported for improved disk I/O on very large deployments Key features Custom traffic categorization (classification). Traffic categorization uses a Cisco access-list style syntax. Webview comes with several predefined categories that work fine, but the real power of this tool is when you add custom categories that match your network's unique traffic patterns -- Email, ERP, backup, Internet proxies, etc. Within an ACL, each line can pass or fail based on any combination of: IP address / mask port number (TCP/UDP) TCP flags ICMP type and code BGP ASN (if configured as an export option) IP Type-of-Service (DSCP, IP precedence or a simple number) next-hop IP / mask exporter IP / mask input or output interface Number of packets or bytes Duration of flow Average bytes per second or packets per second Average packet size The success of another ACL within the past n seconds Below are several ACL examples. simple: ip access-list extended HTTP permit tcp any any eq 80 reverse permit tcp any any eq 443 reverse complex: ip host-list @local 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ip access-list extended Internet_HTTP deny tcp host @local host @local permit tcp host @local any eq 80 reverse permit tcp host @local any eq 443 reverse specific: ip host-list @SAP 10.1.2.15 10.1.3.15 ip access-list extended Columbus_SAP_on_backup_path permit ip any FastEthernet0/0 host @SAP reverse exporter Rtr3 routing-table derived: ip access-list extended YouTube permit ip any 36561 any reverse # YouTube is BGP ASN 36561 flow-derived: ip access-list extended IPT_g711 permit udp any gt 1023 any gt 1023 dscp ef kbps range 76 84 seconds gt 1 # g.711 should be ~80 kbps of high-port UDP for 1+ seconds heuristic: ip access-list extended EPM permit tcp any ge 1024 any eq 135 dynamic EPM flow %MSRPC timeout 1 ip access-list extended MS_RPC permit tcp any any eq 135 reverse permit tcp host $srcip ge 1024 host $dstip ge 1024 flow %MSRPC reverse acl-map: ip host-list @SAP_Servers 10.1.2.15 10.1.3.15 ip host-list @AD_Servers 10.1.2.5 10.1.3.5 10.1.4.5 ip host-list @Proxy_Servers 10.2.0.5 10.2.0.6 10.3.0.5 10.3.0.6 ip access-list map CategoryMap SAP @SAP_Servers ActiveDirectory @AD_Servers Internet @Proxy_Servers Voice @Voice_Servers @Voice_Gateways Epic 10.3.6.0/24 Categories are grouped together to create an ordered "view" which is then applied to one or more exporting devices. Multiple views can be used on the same device (e.g., it's common to have summary and detailed views of the same data). The number of categories is unlimited, though the quantity and order of categories does impact performance. For more info on the ACL syntax, data rendering, and other configuration options, please read the PDF documentation . Graphs and Table reports. Webview uses Flowscan-style "butterfly" graphs showing categories stacked in order of their volume, with input below the axis and output above. E.g., This butterfly view may seem confusing at first, but it's a very practical way to display many traffic categories in both inbound/outbound directions. Naturally, you can generate simple single-axis graphs as well, as well as export the raw graph data to csv/Excel for manual manipulation. Data is aggregated at one-minute resolution, by default. For example, here is the previous graph zoomed in to 8:00 - 10:00 am: One-minute resolution is ideal for most enterprises since it closely matches the human factor of the end user's tolerance / patience. E.g., most users won't notice or be concerned by occasional short periods of slowness but, if the impact is a minute or more, it's almost guaranteed that they'll be unhappy. The default aggregation can be lowered to one second and coupled with flexible netflow's one-second active flow timeout to produce amazingly precise graphs . However, the precision comes at a signifcant CPU/disk cost. If your goal is microburst policing, Netflow is really not the right tool for the job. The graphs above show traffic categories for a router interface. You can also flip this around. E.g., the following graph instead has the single traffic category "TSM" (disk backup) broken out by interfaces named "MPLS/cle" (Cleveland), "MPLS/wau" (Wausau), etc. In addition to traffic volume, Webview also reports on flows, packets, and concurrently active IPs. For example, you might be interested to know what the average bandwidth need is per active user of a certain application. The following report shows that each user of "Internet_HTTP" needs about ~30 Kbps when measured over a business week (8am - 5pm, Monday - Friday): Maximum bps Average bps Date Interface Category In Out In Out Mon Apr 14 2008 LAN/apl Internet_HTTP 27,049 154,515 3,979 23,660 Tue Apr 15 2008 LAN/apl Internet_HTTP 62,212 122,788 6,778 18,697 Wed Apr 16 2008 LAN/apl Internet_HTTP 46,705 235,215 4,974 24,456 Thu Apr 17 2008 LAN/apl Internet_HTTP 46,584 312,958 5,161 30,668 Fri Apr 18 2008 LAN/apl Internet_HTTP 23,755 213,472 4,880 45,318 The graphing engine is very flexible (possibly too flexible!): Clickable graphs. People seem to go ga-ga over this handy feature, and I'm not sure why more commercial packages don't have it. Basically, if you're looking at a graph and see something interesting, you can click on it to find out more. Leads to this... This view goes after the raw flow data, which is generally kept for at least 4-8 weeks (depending on available disk space). Ad hoc query tool. As the previous report shows, there's a nice GUI for exploring and reporting on the raw flow data. It's called the Ad Hoc Query Tool (aka Webview Flow Reporter ...