Given the widespread growth of enterprise networks and the sheer number of companies doing business online, there has become an increasing need for only the best sFlow collectors and analyzers. As more devices make use of the sFlow protocol there is a range of opportunities for administrators to martial this technology to monitor their network activity.
In order to keep your network online it is vital to keep monitoring for performance issues and faults. The cost of overlooking this day-to-day monitoring activity can come at the cost of your network going down. sFlow collection is one of those core monitoring practices that can tell you the precise state of your connected devices.
You can use an sFlow collector to highlight network congestion and identify traffic patterns that could spell problems for your network further down the line. In this article we’re going to look at some of the best sFlow collectors and analyzers on the market but first, we’re going to look at what sFlow is.
What is sFlow?
In a nutshell, sFlow is a packet sampling protocol that is tailored towards monitoring fast-moving enterprise networks. The sFlow protocol was designed to sit within Layer 2 of the OSI model. sFlow works by having an sFlow Agent take packet samples and put them into sFlow Datagrams where they are then sent on to an sFlow Collector. The sFlow Collector can then use this data to analyze network traffic and find the top bandwidth hogs within a network.
Our methodology for selecting sFlow collectors and analyzers tool:
We’ve broken down our analysis for you based on these key criteria:
- Accuracy and depth of network traffic analysis.
- Ease of installation and user interface usability.
- Compatibility with a wide range of network devices and protocols.
- Real-time monitoring and alerting capabilities for network issues.
- Comprehensive reporting and data visualization options.
The Best sFlow Collectors and Analyzers
1. ManageEngine NetFlow Analyzer (FREE TRIAL)
As the name suggests, ManageEngine NetFlow Analyzer is a netflow analyzer that also supports sFlow collection. On ManageEngine NetFlow Analyzer you can use sFlow to collect traffic usage information by protocol, interface, application, and IP address. You can view this traffic usage in real-time and monitor metrics such as speed, volume, packet type, and utilization.
Key Features:
- Supports sFlow collection
- Real-time traffic monitoring
- Visually appealing dashboard
Why do we recommend it?
ManageEngine NetFlow Analyzer excels in real-time sFlow data collection and analysis, supported by its extensive reporting capabilities and customizable dashboard.
There are times when you’ll want to take a step back from live monitoring and look at the bigger picture. ManageEngine NetFlow Analyzer supports this through an extensive reporting feature. You can create sFlow reports on bandwidth usage and compare them with other reports to see if you can spot any abnormalities. These reports can also be customized so that you can monitor your network in a way that is most comfortable for you.
Besides its sFlow collection abilities, ManageEngine NetFlow Analyzer offers one of the most visually-captivating user experiences available. The dashboard is completely customizable and allows you to drag and drop widgets as you see fit. There are over 50 different widgets you can choose from that allow you to view your network usage data.
Who is it recommended for?
This tool is perfect for organizations of all sizes needing a scalable and visually intuitive solution for network traffic analysis.
Pros:
- Extensive and customizable reporting features
- User-friendly and customizable interface
- Scalable for both large and small organizations
Cons:
- May require time to fully customize the dashboard
ManageEngine NetFlow Analyzer is top-tier tool for organizations of all sizes. The design is scalable enough to support larger organizations and SMEs alike. ManageEngine NetFlow Analyzer is available on Windows and Linux. The starting price of this product is $795 (£611). You can download the 30-day free trial.
EDITOR'S CHOICE
ManageEngine NetFlow Analyzer is our top pick for an sFlow collector and analyzer because this system not only communicates with switches and routers through sFlow, but it has NetFlow, IPFIX, cFlow, J-Flow, Netstream, and AppFlow capabilities. That range of protocols gives you freedom of choice when provisioning the equipment for your network. You don’t need to worry whether your network traffic analysis system will be able to communicate with your new switch from a different supplier because this tool can communicate with the products of all network device vendors simultaneously. Alongside the traffic flow protocols, this service includes a packet sniffer that provides protocol analysis. You can easily see how much traffic you have per application and also per endpoint or remote IP address. The system shows you the peaks and troughs of demand on your network at different times of the day or different days of the week. You will be able to take action to shift demand to off-peak times and implement queuing to prioritize time-sensitive traffic, such as VoIP and video streaming. The NetFlow Analyzer enables you to fix traffic bottlenecks without having the expense of buying new network hardware.
Download: Access the 30-day FREE Trial
Official Site: https://www.manageengine.com/products/netflow/download.html
OS: Windows Server, Linux, or AWS
2. Paessler PRTG Network Monitor (FREE TRIAL)
Paessler PRTG is a package of monitoring tools, which are called “sensors.” Each sensor includes a data-gathering probe and an associated screen. There is a sensor for sFlow collection in the PRTG bundle. As well as its sFlow sensor, PRTG offers NetFlow, IPFIX, and J-Flow sensors. It is possible to activate multiple flow sensors in order to monitor multi-vendor environments.
Key Features:
- Supports multiple flow protocols
- Dedicated sFlow sensor
- Extensive alert system
- Freeware version available
Why do we recommend it?
PRTG Network Monitor offers a balanced and comprehensive sFlow collection experience, supported by a dedicated sensor and an extensive alert system.
This system focuses on network activity statistics that are extracted from switches per interface. The information available includes total interface capacity and traffic flow rates inbound and outbound.
By combining information at either end of a link, the system is able to detect when an interface is overloaded. This situation will result in dropped packets and jitter. The PRTG system includes a series of thresholds and, in the case of traffic flows, a typical threshold would be set at a percentage of total interface capacity – for example, at 80 percent.
A capacity threshold will trigger an alert if crossed. Each alert can be set up to be forwarded to technicians by email or SMS. The level of those thresholds needs to be set so that it provides enough time for technicians to take action and head off traffic bottlenecks.
Who is it recommended for?
Ideal for businesses seeking a versatile network monitoring solution with comprehensive flow data collection capabilities.
Pros:
- Supports a variety of flow protocols
- Detailed traffic data collection with sFlow sensor
- Customizable alerts via multiple channels
- Freeware option suitable for small networks
Cons:
- Paid versions can be expensive for larger sensor needs
Paessler offers a hosted SaaS version of PRTG but it is also possible to download the package and run it on Windows Server. You can get a 30-day free trial of PRTG.
3. ntopng and nProbe
Next up on this list we have ntopng and nProbe. nProbe is a network traffic analysis tool that allows the user to collect NetFlow and sFlow data to monitor the connection quality throughout a network. nProbe can collect sFlow data and export it in IPFIX format for further analysis. If you want to monitor network traffic then nProbe is a solid option.
Key Features:
- Network traffic analysis
- sFlow data export in IPFIX format
- Virtual interface for flow collection
- Multiple OS support
Why do we recommend it?
ntopng and nProbe offer a solid combination for network traffic analysis and sFlow data collection, suitable for detailed network monitoring.
ntopng also has its own flow collection abilities. However, in order to conduct flow collection with ntopng you need to create a virtual interface to which you send flows. To do this you need to go to Admin > Plugins and select the sFlow plugin. Ntopng is available on Windows, Cent OS, RedHat, Ubuntu, Debian, and RaspberryPI. Prices for ntopng range from $174 (£133) for the Pro version to $581 (£446) for the Enterprise version.
Who is it recommended for?
Best suited for users requiring a comprehensive tool for monitoring network traffic and collecting sFlow data across various platforms.
Pros:
- Effective for both NetFlow and sFlow collection
- Exports sFlow data for further analysis
- Supports a range of operating systems
Cons:
- Setup may require more technical expertise
Similarly nProbe is available on Windows and Linux. There a few different versions of nProbe that you can purchase. The first is nProbe embedded which costs $58 (£44). The Standard version can be purchased for $174 (£133). The most expensive version is nProbe Pro which has support for additional plugins for $348 (£267). You can view more nProbe and ntopng pricing option on their website.
4. sFlowTrend
sFlowTrend is a free sFlow collector that provides one of the most cost-effective network monitoring solutions available. sFlowTrend can take sFlow data from up to five switches or hosts. It can also store up to one hour of data in memory. This is, therefore, a tool best used by those with small networks with light sFlow collection needs. However, there is also a paid version of sFlowTrend called sFlowTrend-Pro which removes these limitations completely.
Key Features:
- Free and paid versions
- Real-time sFlow data collection
- Visual data representation
- Historical traffic report generation
Why do we recommend it?
sFlowTrend offers a cost-effective solution for sFlow collection with real-time monitoring capabilities and excellent data visualization.
If you opt for the paid version of sFlowTrend you’ll find a versatile sFlow collection tool. You can collect sFlow data in real-time and view the top applications and users hogging your bandwidth. This allows you to point to the worst offenders and target your troubleshooting towards finding a specific solution to aid those weak points.
Usage data can be visualized in a variety of graphs for more clarity. sFlowTrend-Pro users can use historical traffic information to generate reports on past usage. In the event that you need more up-to-date information, you can also generate reports on live information as well.
Who is it recommended for?
Ideal for small to medium-sized networks needing a simple yet effective tool for sFlow collection and analysis.
Pros:
- Real-time monitoring and bandwidth analysis
- User-friendly interface with clear visualizations
- Paid version offers enhanced features for larger networks
Cons:
- Free version has limitations in data storage and switch support
While the free version of sFlowTrend has a number of limitations it is still a viable choice for smaller organizations. For larger enterprises, sFlowTrend-Pro can be purchased from the inmon website. However, you’ll need to create an account in order to view the price and license version you would like to buy. If you’d like to download sFlowTrend totally free.
5. SolarWinds NetFlow Traffic Analyzer with sFlow Collector
First up on the list, we have SolarWinds NetFlow Traffic Analyzer, a network analyzer that includes a robust sFlow Collector Tool. With this tool, you can collect sFlow data and identify which users, applications, and protocols are consuming the most bandwidth. The data you collect is invaluable for identifying those problematic users or applications that are hogging your bandwidth and adversely affecting your network.
Key Features:
- Robust sFlow collection
- Easy installation process
- Identifies top bandwidth users
- Troubleshooting support
Why do we recommend it?
SolarWinds NetFlow Traffic Analyzer is highly effective in collecting and analyzing sFlow data, making it invaluable for identifying and addressing network bandwidth issues.
One of the first things you notice about SolarWinds NetFlow Traffic Analyzer is how easy it is to install. You are taken through the setup process with a configuration wizard. Once you complete the configuration wizard then you can start collecting flow data from sFlow-enabled devices automatically. The fast-track installation and setup of this program makes it a good choice for those who want to get to work ASAP.
SolarWinds NetFlow Traffic Analyzer also has you covered when it comes to troubleshooting as well. This tool highlights the IP address of top talkers throughout your network. You can monitor all the arriving traffic from source IPs, destination IPs, and protocols. With the ability to point to top talkers and conversations, you can run much more effective and informed troubleshooting.
Who is it recommended for?
Ideal for network administrators looking for a comprehensive tool to monitor network bandwidth and troubleshoot effectively.
Pros:
- User-friendly installation and setup
- Efficient identification of high bandwidth usage
- Detailed analysis of traffic by users and applications
- Effective troubleshooting with top talker insights
Cons:
- The starting price may be high for some budgets
If you need a product that has the ability to conduct exhaustive sFlow and NetFlow collection then SolarWinds NetFlow Traffic Analyzer is a product you should bear in mind. SolarWinds Network Traffic Analyzer starts at a price of $1,915 (£1,472). You can also download a 30-day free trial.
6. Wireshark
Wireshark is an open-source tool that has earned the respect of countless administrators over the years based on its abilities as a network analyzer. With Wireshark you can view live and historic sFlow and NetFlow captures. Your monitoring activity can be conducted through a GUI or through the TShark utility-driven TTY mode.
Key Features:
- Live and historic data capture
- GUI and command-line options
- Advanced filtering capabilities
- Wide OS compatibility
Why do we recommend it?
Wireshark is renowned for its robust network analysis capabilities, including effective sFlow and NetFlow data capture and filtering.
A combination of capture and display filters allows you to choose what information you see when monitoring your network. Capture filters are used to determine what type of data you capture while monitoring your network. Display filters allow you to decide what captured data you see when looking through captured data. This allows you to get straight to the most important information without interruption.
Who is it recommended for?
Best for network professionals and enthusiasts looking for a detailed and customizable approach to network traffic analysis.
Pros:
- In-depth live and historical data analysis
- Flexible capture and display filters
- Supports a wide range of operating systems
Cons:
- May be complex for novice users
The overall design of Wireshark makes it easy for you to run captures and sift through data quickly. When you’re finished looking at your data you can export the data in XML, CSV, or PostScript. Wireshark is available on Windows, Linux, Mac OS, Solaris, FreeBSD, and NetBSD. You can download Wireshark totally free.
7. Intermapper
Intermapper is a network analyzer that is targeted towards larger organizations that want fast-paced network monitoring capabilities. It offers support flow support for sFlow, NetFlow, jFlow, and cFlow. As a traffic monitoring tool, Intermapper provides a respectable offering with the ability to view the top talkers, hosts and listeners throughout your network.
Key Features:
- Real-time flow monitoring
- Supports multiple flow types
- Capacity planning tools
- Threshold-based alerts
Why do we recommend it?
Intermapper provides comprehensive real-time monitoring with capacity planning capabilities, ideal for large-scale network environments.
With Intermapper you can monitor flows in real-time. There is little to no latency so the information you see is completely up-to-date. In the event that you need to delve deeper than generic performance data you can see which IPs are connecting to the highest number of hosts. The benefit of this is that it gives you another perspective through which to monitor your service quality.
One of the most important considerations in network monitoring for larger organizations is capacity planning. Intermapper allows you to review historical traffic data to see how your capacity requirements have grown over time. This can help you to predict when you need to upgrade your service to sustain more devices or applications.
Who is it recommended for?
Suited for larger organizations needing fast-paced and detailed network monitoring with advanced planning tools.
Pros:
- Effective for real-time network monitoring
- Capacity planning for future network growth
- Free version available for small-scale monitoring
Cons:
- Pricing information not readily available
This product is available on Windows, Linux, and Mac OS. You can download Intermapper for free if you want to monitor less than 10 devices. If you require more then you will need to pay for a subscription license or device-based license. Unfortunately, you’ll have to contact the sales team to view more information. No matter what platform you’re on, Intermapper is a strong contender among even the best sFlow collectors on this list. Try a 30-day free trial of Intermapper.
8. Plixer Scrutinizer
Plixer Scrutinizer is one of the most well-known network analyzers right now. Plixer classifies Scrutinizer as an incident response system but it is most commonly recognized as a NetFlow and sFlow collector. It is also worth noting that you can use Scrutinizer to capture J-Flow, IPFIX, and NetStream data as well. In short, you have everything you need to ascertain the quality of your service.
Key Features:
- Multiple deployment options
- Supports various flow types
- Scalable flow collection
- Free and paid versions
Why do we recommend it?
Plixer Scrutinizer stands out for its flexible deployment options and scalability, making it adaptable to a wide range of network environments.
One of the things that makes Scrutinizer unique is that there are multiple deployment options. You can deploy Scrutinizer as a hardware appliance, virtual machine, or SaaS solution. This gives you complete customization over the experience you receive from the product.
None of these versions have any effect on the flows supported but they do drastically differ in how many flows can be collected. For example, if you deploy Scrutinizer as a hardware appliance you can collect over 100,000 flows per second. However, if you deploy on a virtual machine you’ll be limited to 40,000 flows per second.
Who is it recommended for?
Ideal for businesses looking for a customizable and scalable solution for network traffic analysis across various deployment scenarios.
Pros:
- Versatile deployment as hardware, VM, or SaaS
- Supports a range of flow data types
- Scalable for different network sizes
Cons:
- Some versions limited in flow collection capacity
There are a number of different licensing options available for Scrutinizer: Free, MDX, SSRV, and SCR. The Free version of Scrutinizer allows you to collect 10,000 flows for up to five hours. The MDX version collects the same amount of flows but keeps the data for 24 hours. The SSRV version also records the same amount of flows but allows you to keep the data for an unlimited period of time. Finally, the SCR version allows you to monitor anywhere between 40,000 to 10 million flows per second. You can download the 30-day free trial for Scrutinizer.
9. Riverbed Network Flow Monitoring
Finally, we have Riverbed Network Flow Monitoring (formerly FlowTraq). Riverbed is a tool that combines sFlow capabilities with a contemporary user interface. Riverbed has the ability to track sFlow, NetFlow, IPFIX, Cflow, and jFlow. You can view your network usage through the lens of some of the most well-designed graphs available. The primary focus of Riverbed is in detecting strange activity and as such provides you with threshold-based alerts.
Key Features:
- Supports multiple flow protocols
- Advanced DDoS detection
- Threshold-based alerts
- REST-API for customization
Why do we recommend it?
Riverbed Network Flow Monitoring offers a modern approach to flow monitoring, combining advanced security features with comprehensive flow data analysis.
Threshold-based alerts notify you when a metric has exceeded normal levels. The alerts system allows you to take a step back from live monitoring without missing anything. Alerts are sent by email. In the event that you want more security, Riverbed also offers you a REST-API which allows you to use your own scripts to interact with the database directly.
However, what really keeps you protected is Riverbed’s DDoS detection. Riverbed can recognise a DDoS attack and react automatically. It is integrated with a variety of security vendors such as A10 TPS, RadWare Defense Pro, Verisign OpenHybrid, and Voxility.
Who is it recommended for?
Best for organizations prioritizing both network flow monitoring and enhanced security measures, such as DDoS detection.
Pros:
- Effective for a range of flow protocols
- Advanced features for security and DDoS detection
- Real-time threshold-based alerts
Cons:
- Pricing and detailed feature information require direct contact with sales team
Overall Riverbed is a tool that offers a well-functioning blend of flow monitoring and security. If you’d like to purchase a copy of Riverbed you’ll need to contact the sales team directly. That being said you can still download a free trial version. You can download Riverbed on a 30-day free trial.
Choosing an sFlow collector
If you’re not already incorporating sFlow collection into your monitoring activities, there are countless reasons why you should be. sFlow data is a resource that expands far beyond the confines of routers and switches. Any organization serious about executing thorough traffic analysis would be well-advised to add sFlow collection to its monitoring practices.
