+1 Plixer/Scrutinizer. Very affordable, powerful, easy to use, very
responsive to service requests. Been happy for years with them.
On 5/19/2014 10:30 AM, Eric Van Tol wrote:
-----Original Message-----
From: cisco-nsp [mailto:[email protected]] On Behalf Of
Scott Granados
Sent: Friday, May 16, 2014 10:16 AM
To: [email protected]
Subject: [c-nsp] Netflow analysis tools?
Good morning,
I'm starting to work with Net Flow data and am looking for both good
background documentation to get more familiar and suggestions for an
analyzer.
Scott,
Disclaimer: Long email, no financial stake in any company discussed.
We recently went through a Netflow comparison between Plixer Scrutinizer and
Solarwinds NTA after evaluating some open source tools which we were not quite
satisfied with. We ended up going with Scrutinizer for a few reasons:
Better pricing model (for us) - we only needed a small number of exporters
(under 25). The SW pricing model is such that the NTA license must follow the
NPM license, so if you have an SLX (unlimited) license (like we have), you need
an SLX NTA license ($15K list). The alternative is that you can purchase
another small 25-node license of Orion *and* NTA. Scrutinizer 25-node license
was less expensive (with appropriate end-of-quarter discounts) and supports
unlimited number of interfaces per exporter. Yearly software maintenance is
less expensive, too.
More version support - Plixer supports v5, v8, v9, and IPFIX formats and
IP/IPv6/MPLS Netflow data. Solarwinds has no plans on supporting IPv6 or MPLS
- IPv6 has been a feature request for more at least 3 years on their support
forum and unless one of their Fortune 500 enterprise customers absolutely
demands MPLS support, forget about that getting added.
Reporting - Scrutinizer supports dozens of reports right out of the box. NTA
only had a dozen or so. The process by which you can build reports in NTA was
more tedious than it is in Scrutinizer.
Analyzation - Scrutinizer has the ability to do "flow analytics" that can
examine the incoming data and identify things like suspected DDoS attacks, botnet
activity, brute force attacks, etc. and alert you based on criteria you set.
OS - NTA requires Windows, obviously, whereas Scrutinizer's virtual appliance
uses ESXi host and is a CentOS guest install. They do have a less-expensive
standalone Windows installer, but it does not support more than around 10K
flows per second (fps), but this may suit you.
Sales - The Plixer sales person was very respectful of my time to make a
decision. He gave me the end-of-quarter parameters and checked in with me once
every week or two weeks or whenever I had a question. The Solarwinds sales
person kept calling and emailing, and just plain being a damned pest about it.
He pissed me off, and to be honest, this was one of the biggest reasons I went
with Plixer. Note to sales people - I don't give a s**t how tenacious you are
- when I tell you not to bug me and flat out tell you that you are being a
pest, you can be sure I won't purchase your product.
Both supply web-based GUIs, configurable dashboards, configurable alerting, and mapping
capabilities. Solarwinds has a more "polished" interface and is definitely a lot more
"pretty" to look at, but when it came right down to it, we felt that Scrutinizer was the
better choice, given the above points. That said, SW NTA is a great product and might be a good
choice if you have executives or non-technical people that like great-looking reports and/or if you
are lonely and feel like talking to a sales droid whose only motivation is to sell you NTA with the
ingrained tenacity of a T-1000 looking for John Connor.
-evt
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
--
Rick Coloccia, Jr.
Network Manager
State University of NY College at Geneseo
1 College Circle, 119 South Hall
Geneseo, NY 14454
V: 585-245-5577
F: 585-245-5579
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
