Netflow monitoring

[Night]

Hello

We're looking for a way to monitor network traffic using a monitor port on a switch. We're not interested in bandwidth, but what type of traffic is passing on that network segment (HTTP, DNS, ICMP etc).
Is it possibile to do this using Zabbix and some opensource third-party tool?

Thank you in advance.

[Hamardaban]

Zabbix - not a traffic analyzer. look in the direction of "Free NetFlow Traffic Analyzer" \ "NetFlow Analyzer" or "Wireshark"

[bbrendon]

If you were only interesting in the type of traffic you could DIY something for zabbix using some netflow tools and maybe ip accounting? Usually type of traffic data would be netflow though which zabbix is 100% the wrong solution for that.

Also sometimes firewalls and WAPs have their own L7 traffic type data that you might be able to pump into zabbix.

One solution : https://github.com/robcowart/elastiflow

IMHO traffic type is probably a waste of time. I can already tell you 90% is TLS which could be anything.

[hkjarral]

NTOP is one good tool to visualize whats going on in your network.