For some time, NetFlow analysis has been one of the core strategies relied on by IT administrators to conduct real-time network monitoring. So much of an enterprise-grade service’s reliability rests on its bandwidth performance. It is in this area that NetFlow analyzers are worth their weight in gold. With a NetFlow analysis tool, an administrator can see how efficiently data is transferred across a network without relying on the large volumes of stored data that regular packet capture procedures create.
Here is our list of the best free NetFlow Analyzers:
- ManageEngine NetFlow Analyzer (FREE EDITION) This paid traffic analysis system uses NetFlow as well as other traffic protocols and is available in a Free edition. Runs on Windows Server and Linux. Start a 30-day free trial.
- Site24x7 Network Monitoring (FREE TRIAL) This cloud service implements network device monitoring and traffic analysis and is packaged with other system monitoring services. Start a free 30-day trial.
- Paessler PRTG Network Monitor (FREE TRIAL) This full stack monitoring package includes NetFlow analysis and free for up to 100 sensors. Runs on Windows Server. Start a 30-day free trial.
- SolarWinds NetFlow Traffic Analyzer This on-premises package is available as an addition to the Network Performance Monitor and it provides traffic analysis with NetFlow and other flow statistics protocols. It runs on Windows Server.
- ntopng A paid packet sniffer that includes a traffic analysis feature and has a free Community edition. Available for Windows, Unix, Linux, and macOS.
- Plixer Scrutinizer A paid traffic collector and NetFlow analyzer that has a free version. Runs on Hyper-V or VMware.
- The Dude A free network discovery and mapping tool that is based on SNMP. Runs on Windows, macOS, and Linux.
- WireShark This free packet sniffer has its own searching and filtering language and enables extensive traffic analysis. Runs on Windows, macOS, and Linux.
- FlowScan This free network analyzer can show time series graphs of traffic throughput and store traffic attributes in a database. Runs on Linux or Unix.
- sFlow Toolkit A free analyzer for packet data that works on a tcpdump input and generates sFlow-format records. Runs on Linux and Windows.
- Colasoft Capsa A protocol analyzer with paid and free editions that displays graphs of traffic data. Runs on Windows.
From a glimpse, you can identify whether your network is performing as it should be or whether an underlying issue is decreasing the standard of service. In a nutshell, deploying a NetFlow analyzer helps determine whether a network is experiencing poor performance, and it conducts troubleshooting if a problem is found. In this article, we look at the Best Free NetFlow Analyzers on the market.
What is a NetFlow Analyzer?
NetFlow is the term given to a network protocol designed by Cisco to collect IP traffic and conduct network monitoring. NetFlow analyzers collect data generated by devices throughout the network and allow the user to view historic and real-time perspectives of the network.
When viewed with a NetFlow analyzer, the data obtained from network devices reveals key details like port numbers and IP addresses. More importantly, it allows you to view the source and destination of all NetFlow traffic. Each device must enable NetFlow in order to see NetFlow data.
Why Do I Need a Netflow Analyzer?
A NetFlow analyzer offers you one of the best tools to take stock of what is happening on your network. It allows you to interpret real-time and stored traffic data from your network and look for causes of poor connectivity. This helps to make sure that you don’t experience downtime on account of unresolved issues. The main reasons why administrators use Netflow Analyzers are listed below:
- Develop a network inventory – Auto discover devices on your network and map out network infrastructure.
- Analyze a network in real-time – Viewing live traffic on your network and looking out for signs of poor performance.
- View historical traffic data – View old usage statistics to develop further insights into your connection.
- Notifications – Receive notifications when network problems are detected, e.g latency or compromised devices
The Best Free NetFlow Analyzers
1. ManageEngine NetFlow Analyzer (FREE TRIAL)
Next up on our list, we have ManageEngine NetFlow Analyzer, a network analyzer that has become a staple in the toolkit of many administrators. NetFlow analyzer can tell you almost everything about your network down to devices, conversations, and interfaces along with their volume, utilization, and speed. All this information is translated into visual formats like graphs so you can find out exactly what’s going on.
Graphs and displays update in real-time, showing top interfaces, protocols, and conversations. This platform is great in an enterprise environment because it offers the user a number of automation features. For example, you can set the parameters of the alerts you see. If traffic goes above or below a defined level, you’ll be notified immediately. You don’t have to stay glued to the desk in order to stay up to date.
On the main screen, a breakdown of current alerts shows every warning that has been raised. Like PRTG, NetFlow Analyzer allows the user to develop custom reports. This allows you to run in-depth diagnostics and troubleshooting on your network based on the historical data you have available. This is useful for correcting faults and optimizing your network.
Overall this is a solid platform whether you’re operating within an SME or a larger organization. With the free trial version, you can monitor an unlimited number of interfaces. Unfortunately, you’ll be limited to two once the trial period ends. You can download a 30-day free trial.
2. Site24x7 Network Monitoring (FREE TRIAL)
The Site24x7 Network Monitoring module is part of full stack observability systems. This service provides network discovery and inventory creation. This service is provided by SNMP procedures, which constantly cycles to check on the availability and health of network devices, simultaneously checking on the current status of the inventory. The tool also draws up a network topology map.
The traffic analysis service in the Network Monitoring package is able to communicate with network devices through the NetFlow, sFlow, J-Flow, CFlow, IPFIX, AppFlow, and NetStream protocols. This gives the system the ability to communicate with devices from any provider.
The traffic analysis system includes automated Quality of Service assessors for VoIP. These compile IP SLA and MOS statistics and protocol analysis that will help you implement traffic shaping measures.
Site24x7 creates packages of its monitoring services and all of the include the Network Monitoring module. This is not a free system but you can use it for nothing by accessing the 30-day free trial.
3. Paessler PRTG Network Monitor (FREE TRIAL)
PRTG Network Monitor is as close to comprehensive as it gets in terms of network monitoring and NetFlow analysis. PRTG supports NetFlow, J-Flow and sFlow protocols making it versatile enough to function as a NetFlow tool in most organizations. Network Monitor has become a popular platform on account of its user interface. The navigation tree is very simple so that you can cut straight down to the minutiae of your network traffic.
Likewise, the setup process is very easy. Auto-discovery finds active devices on your network. This automation is something that carries over into Paessler’s use of alerts as well. You can configure alerts to be sent to you via email or SMS. If PRTG Network Monitor clocks any Netflow or network activity on your network, alerts will be sent straight to you to take action. You can also translate your data into historic data reports in PDF, HTML, CSV and XML.
Overall PRTG Network Monitor is a great product because of its usability. It’s incredibly easy to get started up and conduct NetFlow analysis. While the basic PRTG Network monitor is free, there are a number of different paid products as well. Paessler PRTG can be downloaded as a free trial.
4. SolarWinds NetFlow Traffic Analyze
SolarWinds is a big name in the world of network monitoring, and NetFlow Traffic Analyzer is perhaps the most competitive packet monitoring solution available. This product allows the user to monitor their real-time network and bandwidth usage. You can view your network usage and also packet capture data through a web-based application.
One of the main selling points of NetFlow Traffic Analyzer is that it is easy to use. The stripped-back design of the user interface makes it easy to see what’s going on with your network. The tool generates graphs that display usage data in real-time. These graphs allow you to quickly determine which devices and applications consume the most bandwidth.
NetFlow Traffic Analyzer’s graphs update automatically in real-time, so you can immediately identify how well your network is performing. You can tell in a matter of seconds if your network experiences poor quality of service. This is one of the features that makes SolarWinds NetFlow Traffic Analyzer out top pick on this list.
This tool pack includes a simple interface to turn the NetFlow capabilities of your Cisco routers on and off. It also has a tool that replays stored traffic data so you can watch the performance of your network. A third utility will generate extra traffic so you can test your infrastructure in preparation for a planned increase in load on the network. Start a 30-day free trial here.
5. ntopng
ntopng has developed a reputation as one of the most formidable free network traffic monitors. This versatile tool runs on Windows, Unix, and Mac OS. ntopng runs through an encrypted web-based user interface that shows a real-time breakdown of active network traffic. The web-based console is great for organizations looking for fast and flexible deployment.
You can view NetFlow data in a variety of ways right down to active flows by application. You can also see how much latency you have on your network at one time. The platform does this by breaking down the networks 3-day handshake packets and calculating the time it takes for them to transfer. The latency is determined by how long it takes for the packets to move across the network.
The user interface either doesn’t fall short, either. You can choose a variety of visual displays to look at and comb through your historical data by time and date. This ensures you don’t miss anything and can make the necessary adjustments if you spot poor performance.
The free version of ntopng is called the Community version and can be downloaded from here. Ntopng is highly recommended if you want to deploy a low-maintenance NetFlow analyzer that doesn’t need much configuration.
6. Plixer Scrutinizer
In terms of scalability, few products offer as much potential as Scrutinizer. Scrutinizer can function in a variety of SME and larger enterprise environments with the capacity to handle millions of flows per second. In addition, Scrutinizer offers a great user interface lets you delve down deep into the time frame, host application, and protocol of all your network elements. It’s also versatile in the sense that it supports NetFlow, sFlow and IPFIX.
A reporting feature breaks down NetFlow data for further analysis. Overall this is a great platform and the free version doesn’t restrict the number of interfaces you can monitor. As a result, it can be deployed seamlessly within a larger organization. Scrutinizer can be downloaded for free from here.
7. The Dude
MikroTiks’ The Dude is quite a famous name within the network monitoring community. This tool is considered to be one of the best value products available online. With support for SNMP, ICMP, DNS, and TCP, The Dude can function within even the most demanding network environment.
One of the draws of The Dude is that it is simple to deploy. An auto-discovery feature automatically recognizes devices on the network so you don’t have to spend time messing around with configurations. You can also use this information to draw up maps and create a topological perspective.
Overall, The Dude is very easy to use and install. If you want a tool to hit the ground running, then this is a solid option. Though it is not as slick as SolarWinds NetFlow Traffic Analyzer, it still provides a competitive offering. The Dude operates on Windows, MacOS, and Linux. The Dude can be downloaded from here.
8. WireShark
WireShark is one of the most well-known NetFlow analyzer tools in the world. At one point or another almost every network administrator has dabbled with WireShark or considered it. WireShark’s core platform can conduct real-time NetFlow analysis on an enterprise scale. Most administrators use WireShark to identify when a bottleneck occurs.
WireShark can capture Wifi, Bluetooth, Ethernet, VLAN, and USB traffic from devices across a network. This helps produce a complete perspective of an entire network. One particularly useful feature offered by WireShark is that of filters. Display filters determine what type of protocol traffic is displayed when analyzing netflows.
This is an extremely useful feature because it can often be incredibly difficult to manually sift through thousands of NetFlow processes on an active enterprise network. It also helps in regards to troubleshooting. As such, if you require a network analysis tool that is built with troubleshooting in mind, then give WireShark a try.
WireShark is a well known tool because it offers one of the most compelling free network analyzers on the market. Whether you’re working within an SME or a larger organization, this tool has more than enough power to sustain even the heaviest NetFlow workload. WireShark is available for Windows, Linux, and Mac OS. Download WireShark for free here.
9. FlowScan
FlowScan is one of the most basic NetFlow Analyzers on this list. What it lacks in complexity it makes up for in its one-track approach to network monitoring. FlowScan produces real-time graphs of your network activity. While these aren’t as polished as a tool from a company like ManageEngine, they are clear enough to generate a realistic appraisal of live activity.
Two main components make up FlowScan: CampusIO and SubNetIO. CampusIO is referred to as a ‘report module’ that interacts with the raw flow data and pushes it into a database with packet, byte, and flow counters. SubNetIO effectively does the same thing as CampusIO but adds per-subnet statistics on applications to the mix as well. FlowScan can be downloaded from here.
10. sFlow Toolkit
sFlow Toolkit has to be one of the top NetFlow analyzers for analyzing sFlow data. This tool is based around a command-line interface and lets users create scripts to customize their traffic flow analysis. SFlow is compatible with tools such as tcpdump and ntop, which helps increase its reach.
For those experienced with command-line interfaces, sFlow Toolkit is a competent tool. For example, entering the command sflowtool -t | tcpdump -r launches a decoded packet trace. You can then filter these packets using tcpdump.
While sFlow toolkit is a very useful platform, it is best used as part of a wider network analysis strategy rather than an overarching tool. It is good at analyzing sFlows but not much else. If you’re interested in downloading sFlow Toolkit, click here.
11. Colasoft Capsa
Finally, we have ColaSoft Capsa. Capsa is a platform aimed at medium-sized networks that allows the user to conduct TCP flow analysis, network protocol analysis, and VOIP analysis. This is truly a network monitoring tool for diverse and dynamic IT environments. Capsa supports over 300 protocols, making it one of the most versatile tools on this list.
One of the biggest advantages of Capsa is its security features. Capsa can detect when suspicious activity occurs on your network. For example, if it flags external TCP port scanning or a DDoS attack, you will be notified. It also monitors network usage traffic in real-time so you can see exactly what’s going on. You can also set notifications to be sent straight to your email so you know when to take action.
Capsa is truly a platform designed for those in need of versatility. The user interface is quite robust, but this isn’t the platform’s main appeal. Capsa’s combination of security and analysis is really what makes it stand out. ColaSoft Capsa can be downloaded from here.
NetFlow data structures
The Cisco NetFlow system is the industry standard for network traffic measurement. Many other manufacturers implement NetFlow on their devices and the other traffic messaging systems are based on NetFlow procedures. So the way this standard structures data is significant.
NetFlow reports on traffic in both directions on network devices. For incoming network traffic it tracks:
- IP-to-IP packets
- IP-to-MPLS (Multiprotocol Label Switching) packets
- Frame Relay-terminated packets
- ATM-terminated packets
For outgoing traffic, NetFlow records:
- IP-to-IP packet
- MPLS-to-IP packets
Each traffic flow is identified by seven key fields. This means that all data collected by NetFlow can be sorted, filtered, or grouped by any of these attributes :
- Source IP address
- Destination IP address
- Source port number
- Destination port number
- Layer 3 protocol type
- Type of service (ToS)
- Input logical interface
Although many network devices have NetFlow capability, you will need to check on that status for each of your network devices. Some manufacturers shop their NetFlow-capable devices with the messaging protocol disabled, so you will have to visit each device on your network and make sure that it has NetFlow messaging turned on when you first install your NetFlow analyzer.
