6 Best Bandwidth and Traffic Pattern Analysis Tools
In order to keep networks running smoothly, we need to keep an eye on things. Unfortunately, networks are not the easiest of things to examine. Network traffic moves within cables and wires–or through the air–and it does so at a speed that would prevent us to see anything, even if it were possible. To see what’s going on on your network, you need the proper tools. This is exactly what this article is about. We’ve searched the market looking for the best bandwidth and traffic pattern analysis tools. We’ve found quite a few. Some are combined tools that will provide both bandwidth and traffic pattern analysis while other will only do one or the other. We’ll leave it up to you to choose whether you want to use a combined tool or if you prefer one type of tool over the other.
And to make it easier for you to pick the best tool for your specific needs, we’ll start off with some theory about bandwidth and traffic pattern analysis. We’ll try to explain what each is, how it works and how they differ from each other. When we’re done with this theory, we’ll review the best tools we could find. We’ll first discuss the combined tools or bundles that offer both functionalities and then, we’ll introduce the best bandwidth analysis tools followed by the best traffic patterns analysis tools.
Bandwidth Analysis — What It Is
In one sentence, bandwidth analysis is the process of measuring the bandwidth utilization of network circuits. Let’s explain. Imagine a LAN circuit with a 1 Gbps capacity. This figure means it can carry up to 1 Gigabit of data per second. But that doesn’t mean it IS carrying that much data. You could compare it to a highway. A four-lane highway with a speed limit of 55 miles per hour can carry a certain number of cars per hour. If you want to know, at any given time, how many cars go by, you have to count them. This is what these rubber hoses that are sometimes stretched across roads are used for. Similarly, if you want to know how much network traffic there is at a given point and time, you need some tool to measure it.
Bandwidth monitors are exactly that, tools that measure the actual utilization of network circuits. They typically measure the bandwidth usage at different points on a network at frequent time intervals–such as every five minutes–and plot it on a graph that shows its evolution in time. This is quite useful as it allows you to see the evolution of the utilization as well as to gain some knowledge of the times when there are utilization peaks. This is an invaluable tool for capacity planning.
How it Works – SNMP In A Nutshell
The Simple Network Management Protocol, or SNMP, is the basis of most network bandwidth analysis tools. The protocol was invented to manage networking devices but its most common use is monitoring. An SNMP-enabled device has several parameters or variables–called OID for Object Identifier–that can be read by SNMP monitoring tools. Of particular interest when monitoring bandwidth are two parameters that are available for each interface of a networking device, the bytes in and bytes out counters. They are simply counters that are incremented each time a byte is received or transmitted on an interface.
If a bandwidth monitoring tool read these counters at a regular and known interval (five minutes is a common figure), using simple math, the average bandwidth utilization per five-minute period can be calculated. It’s just a matter of subtracting the previous counter value from the current one to get the number of bytes in five minutes, multiplying it by eight to get the number of bits and dividing that by 300 to get the number of bits per second. Most tools will save the counter values in some sort of database or file and plot the utilization values on graphs or use them to build tables.
How About Traffic Patterns?
While bandwidth analysis tools are great to measure the utilization of a network segment, they don’t tell us much about the nature of that utilization. Sometimes, it would be very useful to know what type of traffic or what users are utilizing the available bandwidth. This is where network traffic pattern analysis comes in.
Analyzing network patterns can provide useful information such as the distribution of traffic by type. For instance, while SNMP monitoring would tell you that a given circuit is used at 90% of its capacity (a figure that is way too high and shall be avoided at all costs), traffic pattern analysis could tell you that 50% of that traffic is web browsing and that 10% is email. But it doesn’t stop at traffic types. Traffic could also be reported by source and/or destination IP address. And by adding some extra intelligence and connecting the monitoring tool to other components of the infrastructure such as the AD domain controllers, traffic can also be sorted by user.
So, while SNMP monitoring gives you details about the quantity of traffic on a circuit or segment, traffic pattern analysis will give you qualitative details about the traffic. This feat is accomplished using different flow analysis protocols, the main one being the NetFlow protocol, originally from Cisco but now present on devices from multiple vendors.
A Real Quick NetFlow Primer
Without going too technical, let’s try to explain how NetFlow works. Contrary to SNMP where the devices only keep counters and the monitoring tools do much of the hard work, much of the burden of NetFlow is on the devices themselves. NetFlow-enabled equipment runs some built-in software integrated into the operating system that generates flow data about each traffic flow that goes through it.
It is the equipment’s NetFlow process’ job to recognize flows and to assemble details about each one. Flow data is not kept on the devices. As soon as a flow terminates, its data is sent to a NetFlow collector. The collector’s job is to receive flow data from multiple devices and store it in an orderly fashion. The next component in the chain, the NetFlow analyzer, read the flow data from the collector and displays it in a meaningful way, typically using graphs. In most instances, the NetFlow collector and analyzer are two components of the same software.
The Best All-in-one Or Combined Tools
The first type of tool we’re looking at is all-in-one or combined tools. These are tools that offer both bandwidth monitoring via SNMP and traffic pattern analysis using NetFlow. One tool on our list is a true combined tool while the other is actually a bundle of two separate tools that are purchased together.
1. SolarWinds Network Bandwidth Analyzer Pack (FREE TRIAL)
SolarWinds is a common name in the field of network administration tools. It’s been around since 1999 and has produced some of the best free tools targeting specific tasks of network administrators. But SolarWinds reputation stems mostly from making some of the best bandwidth monitoring tools and the best NetFlow collectors and analyzers. Respectively called the SolarWinds Network Performance Monitor and the NetFlow Traffic Analyzer, the two tools can be purchased together as the SolarWinds Network Bandwidth Analyzer Pack, the first entry on our list.
The first component, the Network Performance Monitor or NPM is a feature-rich SNMP network monitoring system. It boasts an easy to use web-based dashboard, it is easy to set up and configure and, more importantly, it does an excellent job. The tool’s customizable alerting features will notify you whenever specific metrics exceed a predefined value.
NPM can also build intelligent maps of your network and can display the critical path between any two points, facilitating the troubleshooting process. The software has wireless network monitoring and management built right into it. Another great feature is called Network Insights. It is available for Cisco Nexus and ASA devices as well as F5 load balancers. This module provides advanced monitoring of several parameters that are specific to these devices.
The second component of this bundle is the NetFlow Traffic Analyzer or NTA. Using the Netflow protocol, this tool provides more detailed information about traffic flows on your network. Instead of just showing bandwidth usage in bits per second, it can provide detailed information on what the observed traffic is. It can, for instance, report on what type of traffic is more frequent or what user is using the most bandwidth. Several different views are available on the tool’s dashboard such as top applications, top protocols or top talkers, for instance.
The NTA relies on the NetFlow protocol to gather detailed usage information from your network devices. Although NetFlow is originally from Cisco, it is now included in equipment from many vendors. It may have a different name such as J-Flow on Juniper devices but all variants are supported by the NTA. In recent years, the NetFlow protocol has been standardized by the IETF as IPFIX, or IP Flow Information Exchange. IPFIX, of course, is also supported by the NTA.
Prices for the SolarWinds Network Bandwidth Analyzer Pack start $4 910 for monitoring up to 100 elements. Other options are available allowing more devices with top tier having unlimited devices. For those who’d prefer to try the product before buying it, a free 30-day trial can be downloaded from SolarWinds.
2. Paessler Router Traffic Grapher
The Paessler Router Traffic Grapher, or PRTG, is another tool that combines SNMP bandwidth monitoring with NetFlow collection and analysis features. According to Paessler, PRTG is one of the easiest and fastest tools to set up. The company claims you could be up and running within minutes. This might be somewhat of an overstatement but it is true that setting up the product is impressively fast. This is partly due to its auto-discovery feature in which PRTG scans your network and automatically adds the components it finds.
The user interface is another place where PRTG shines. In fact, there are several user interfaces to choose from. There’s a native Windows console, an Ajax-based web interface, and there are mobile apps for Android or iOS. One of the unique mobile apps features will let you scan a QR code affixed to your equipment to quickly view its status.
As far as monitoring goes, PRTG uses SNMP to monitor bandwidth utilization but it doesn’t stop there. Using a concept called sensors, PRTG can also use WMI for Windows hosts and NetFlow or Sflow for networking devices.
This tool’s pricing is based on the number of sensors you’re using where a sensor is any parameter or metric you need to monitor. For instance, each interface monitored via SNMP counts as one sensor. Similarly, each NetFlow data source is another sensor. PRTG is available in a full-featured free version which is limited to monitoring 100 sensors. For more sensors, paid licenses are available. Prices vary according to sensor capacity from $1 600 for 500 sensors to $14 500 for unlimited sensors. A free, sensor-unlimited 30-day trial is available for download. Once the trial period ends, it will revert back to the free version with a 100 sensors limit.
The Best Bandwidth Monitoring Tools
While integrated tools or software bundles are interesting, some might prefer to go with individual tools. For that reason, we’re including a few of the best bandwidth monitoring tools. Remember that both the SolarWinds Network Performance Monitor and PRTG from the previous list are among the best bandwidth monitoring tools as well.
3. ManageEngine Network Bandwidth Monitor
ManageEngine is another common name in the field. The company makes several products, both free and paid, for administering networks. The ManageEngine Network Bandwidth Monitor is a free tool which is part of ManageEngine’s OpUtils bundle, a huge pack of some 16 free network management utilities. The tool runs on both Windows and Linux and the free edition allows monitoring up to 10 devices and their interfaces.
The tool has auto-discovery and once devices are discovered, their interface’s statuses and parameters can be viewed from the inventory tab. You can also display graphs of network speed and bandwidth usage. Reports on bandwidth usage over the past 12 hours to one month can also be generated for each interface. Furthermore, alerts by email or text message can be triggered whenever parameters are out of normal range.
With its 10 devices limit, the ManageEngine Network Bandwidth Monitor is not for everyone, though. For larger networks, there is also a paid version with no device limitation. It is available as a free 30-day evaluation version which will revert to a device-limited version once the trial period ends.
4. Cacti
Cacti is one of the most-used and of the oldest free and open-source monitoring platform. Not as feature-rich as many commercial products, it is still an excellent tool. The tool’s web-based user interface has a vintage feel to it but it is well laid out and easy to use. Cacti includes a fast poller, advanced graphing templates, and multiple acquisition methods. It mainly uses SNMP polling but custom scripts can be devised to get data from virtually any source.
This tool’s main strength is in polling devices and graphing the data on web pages. It’s very good at that but that’s about all it will do. But if you don’t need alerting or other extras, the product’s simplicity might be just what you need. Written entirely in PHP, the software is highly customizable and you can easily adapt it to our specific needs.
Cacti makes extensive use of templates to ease configuration. You have device templates for many common types of devices as well as graph templates. There’s also a huge online community that writes custom templates of all kinds and some equipment manufacturers offer downloadable Cacti templates.
The Best Traffic Pattern Analysis Tools
If traffic pattern analysis is what you’re looking for, our exploration has revealed a few interesting tools that provide NetFlow collection and analysis features.
5. ManageEngine NetFlow Analyzer
The ManageEngine NetFlow Analyzer provides a detailed view of traffic patterns. The product is controlled by a web-based interface and offers an impressive number of different views on your network. You can, for instance, view traffic by application, by conversation, or by protocol. You can also set alerts to warn you of potential issues. For example, you can set up a traffic threshold on an interface and be alerted whenever traffic exceeds it.
The tool comes with several very useful pre-built reports that are tailored for specific purposes such as troubleshooting or capacity planning. The tool also allows administrators to create custom reports to their liking. Its dashboard includes several pie charts with depicting data such as top applications, top protocols or top conversations. It can also display a heat map with the status of the monitored interfaces.
The ManageEngine NetFlow Analyzer supports most flow technologies including NetFlow (of course), IPFIX, J-flow, NetStream, and a few others. The Product comes in two versions. The free version is identical to the paid one for the first 30 days but it then gets limited to monitoring only two interfaces or flows. Paid licenses are available in several sizes from 100 to 2500 interfaces or flows with prices varying between about $600 to over $50K.
6. Scrutinizer
Our last entry for today is a product from Plixer called Scrutinizer. This is more than just a NetFlow Analyzer and many view it as a full incident response system. With its ability to monitor different flow types such as NetFlow, J-flow, NetStream, and IPFIX, you’re not limited to monitoring only Cisco devices.
Scrutinizer features a hierarchical design and offers streamlined and efficient data collection. It allows one to start small and easily scale way up to millions of flows per second. This tool can help you quickly find the real cause of most any network issues even if it has nothing to do with the network such as when a server responds slowly. It can operate reliably in physical and virtual environments and comes with advanced reporting features.
Scrutinizer is available in four license tiers from the basic free version to the full-fledged SCR. The free version is limited to 10 thousand flows per second and it will only keep raw flow data for 5 hours but it should be more than enough to troubleshoot network issues. You can also try any level of license for 30 days after which it will revert back to the free version.