NetFlow

[STC]

Hi there,

does anyone perhaps know if there is a Netflow Collector Plug-In for Zabbix? If not, then perhaps recommend something suitable, commercial are just so damn expensive!

Thanks in advance.

[nelsonab]

There are no netflow collectors that I've heard of in the forums. The closest would be an agent I wrote in Ruby which interfaces with LibPCap. What are you hoping to do?

[STC]

Essentially just report on what protocols are passing through certain interfaces so we can plot traffic trends

[nelsonab]

You can do that with the Ruby agent. I use it to monitor traffic for a rack in a colo.

Here is an example screenshot. As you can see for the host EPG there is one filter for port 80 (Web) and another for port 25 (SMTP) and so forth.

If you want to filter by any address with a specific port (protocol) that will require some modification of the agent, but that shouldn't take more than an hour or two of effort, extending the agent is very simple.

[troffasky]

Ntop has a good netflow collector.

What is the source of the netflow data? If you're using Cisco kit with the right IOS, you'll be able to create a template for Zabbix to poll NBAR stats. Here's a guide for MRTG, shouldn't be too hard to translate it to Zabbix:

http://vermeer.org/docs/6