RE: Anything similar to ARGUS for sFlow ?

From: Peter Phaal (
Date: 03/25/02

  • Next message: Sonia Panchen: "FW: Comments on sFlow RFC 3176"

    Sean O'Neil wrote:
    > So I'm looking for something like ARGUS to create the sflow
    > flow data ... Unfortunately
    > right now,
    > sFlow apparently requires access to sflow capable hardware -
    > I don't have
    > access to a piece sflow capable hardware. Just looking for
    > an alternative
    > to NTOP.

    Even if you don't currently have sFlow capable routers and switches, you can
    still experiment with sFlow. InMon has a free software-based probe that will
    monitor a switch/router using the mirror/SPAN port (see ). There is also source code for
    an sFlow agent (see ). The code compiles to
    provide a host-based traffic monitor, but it can also be used to build your
    own probe, or to add sFlow monitoring to existing packet forwarding
    applications (such as routing, firewall etc.)

    InMon also offers free evaluations of its commercial version of the sFlow
    Probe. This version of the probe can monitor a number of Gigabit mirror/SPAN
    ports at wire speed (see ).

    > You mentioned several network monitoring tools with
    > capabilities similar to
    > ARGUS - can you provide a list please ? VERY interested in this.

    I had been thinking along the lines of traffic analysis applications I
    mentioned in my previous message ( ). However, if you are
    primarily interested in generating flow records, then there are fewer
    options. In addition to the sFlow probe (see above), Netramet ( ) and Coral Reef ( ) are applications that
    provide flow record generation capabilities.

    You didn't mention the type of network equipment you have. Depending on the
    vendor and model, the switch/router may provide sFlow (see ), LFAP (see ) or
    NetFlow (see ) data export.

    Peter Phaal
    InMon Corp.

    This archive was generated by hypermail 2b29 : 03/25/02 EST