2019年12月8日 星期日

NetFlow Collector and Analyzer on Win10



There are several software have been recommanded to work as NetFlow Collectors and Analyzers for Windows 10.

  1. Ntop. Ntop cannot be acted as a NetFlow collector any more. The function of being a NetFlow collector has been moved to nProbe. Howerver, a license is required for nProbe to work.
  2. Pasessler PRTG. PRTG Network Analyzer, accompany with Redis and Win10Pcap, can be acted as a NetFlow colletctor. By using the log stream data (for debuging) function, we may find flows are recored in CSV format in StreamLog directory. However,  PRTG drops information about number of packets and TCP flags which are quite essential to network analysis.
  3. ManageEngine NetFlow Analyzer. The NetFlow Analyzer, accompany with PostgreSQL, can be act as a NetFlow colletor. By enable the storage setting for raw data, the flow records can be viewed by generate Forensics report.