5 Best Network Traffic Analyzers

Network Traffic Analyzers let network administrators and managers get an excellent grasp of not only how much a network is utilized but, more importantly, HOW it is utilized. It is one thing to know that a given network segment suffers from congestion but being able to figure what is causing that congestion gives you a whole new perspective. Without that information, the only option for fixing congestion issues is to throw more bandwidth at it—a temporary solution at best. Bandwidth being still expensive, there are certainly better ways to address this type of issue.

Network traffic analysis may hold the answer and today, we’ll explain what it is and review some of the best tools you can use.

We’ll begin our journey into network traffic analysis with some useful theory. We’ll first have a closer look at what it actually is. This is important as we want everyone to be on the same page for the remainder of our discussion. Next, we’ll introduce NetFlow and other similar flow-reporting systems and protocols. They are at the core of most traffic pattern analysis tools. Without them, there possibly wouldn’t be any network traffic analysis.

We’ll start by having a look at Cisco’s NetFlow technology and its multiple variants before we have a look at S-Flow, a competing system that is somewhat different in how it operates although it serves a similar purpose. With all this information, we’ll be ready to review the top network traffic analyzers that are currently available.

About Network Traffic Analysis

In its simplest expression, network traffic analysis—sometimes called pattern analysis—is the process of recording, reviewing and/or analyzing network traffic for the purpose of performance, security and/or general network operations management. More specifically, it is the process of using manual and automated techniques to review granular-level details and statistics about ongoing network traffic.

There are primarily two types of network traffic monitoring. The first is bandwidth utilization monitoring which can provide quantitative data. This type of monitoring will let you see how much traffic is going by at a specific point on a network but it won’t provide any data on the nature of this traffic. The second type of monitoring, the one that we’re discussing today and which is referred to as network traffic analysis goes deeper and its primary objective is to offer an in-depth insight into what type of traffic, network packets or data is flowing through a network as well as its source and destination.

Although network traffic analysis can be done manually, it is would be a rather tedious endeavour and it is most often done using network monitoring tools. The traffic statistics obtained from network traffic analysis can help with understanding and evaluating the network’s utilization. It will reveal important data on the type, size, origin, and destination of data packets. It can even include some information on the content of data packets.

Network security teams can use network traffic pattern analysis to identify malicious or suspicious packets within the traffic. Likewise, network administrations seeking to monitor download and upload speeds, throughput, content, etc. will use it to better understand network usage.

On the downside, network traffic pattern analysis can also be used by attackers and/or intruders to analyze network traffic patterns and identify vulnerabilities or means to break in or retrieve sensitive data. This, like many technologies, is a double-edged sword.

NetFlow And Other Flow-Reporting Systems

NetFlow is a feature that was introduced on Cisco routers back in the mid-1990s, give or take a year or two. The technology offers the possibility to collect IP network traffic as it enters or exits an interface. This is different from bandwidth monitoring where data is counted but not collected. By analyzing the collected data, one can determine things such as the source and destination of traffic, class, and type of service, and, ultimately use this information to identify the causes of congestion or other network issues.

A typical NetFlow monitoring setup is made up of three main components:

• The flow exporter aggregates packets into flows and exports flow records towards one or more flow collectors. This is the component that resides within the networking device.
• The flow collector is responsible for the reception, storage and pre-processing of flow data received from a flow exporter.
• The flow analyzer analyzes the received flow data in the context of intrusion detection or traffic profiling, for example.

A flow, in NetFlow parlance, is a unidirectional sequence of packets that share a certain number of attributes such as their ingress interface, source and destination IP addresses, IP Protocol (TCP/UDP/ICMP, etc.), source and destination IP ports, and IP type of service. In other words, it corresponds to a network session. Detailed data about each individual flow is collected by the flow exporter before being exported to the flow collector. In most instances, the flow collector and analyzer are two components of the same system and we rarely see them separated.

ALSO READ: 5 Best Tools for Traffic Pattern Analysis

Once a Cisco-exclusive, NetFlow is now available on equipment from many vendors including Juniper, Alcatel-Lucent, and Nortel, just to name a few. Some vendors call it a different name such as J-flow for Juniper. There’s even a relatively recent IETF-standardized version called IPFIX which stands for Internet Protocol Flow Information eXport.

There is also sFlow from InMon, a somewhat equivalent yet widely different technology. sFlow uses similar methods for collecting flow information but adds data sampling—hence the S—for even more detailed information. Only a few NetFlow analyzers and collectors can handle sFlow data as the two are too different.

The Best Network Traffic Analyzers

There are way too many network traffic analyzers using NetFlow or sFlow, potentially making the selection process a daunting challenge. To help you, we’ve put together this list of some of the very best tools for network traffic analysis. Each of them is worth giving it a look.

1. SolarWinds NetFlow Traffic Analyzer (FREE TRIAL)

First on our list is the SolarWinds NetFlow Traffic Analyzer or NTA. If you don’t know SolarWinds, the company has acquired a top reputation for making some of the best network management tools. Its flagship product, the Network Performance Monitor is one of the best bandwidth monitoring tools available. The company is also known for its great free tool addressing specific network administration needs such as one of the best subnet calculators or TFTP servers.

As its name implies, the SolarWinds NetFlow Traffic Analyzer uses the NetFlow protocol to collect detailed information on what the observed traffic is. It can, for instance, report on what type of traffic is more frequent or what user or device is using the most bandwidth. Several different views are available on the tool’s dashboard such as top applications, top protocols or top talkers, for instance. The tool will support most NetFlow variants from different manufacturers.

Among some of the SolarWinds NetFlow Traffic Analyzer’s best features:

• It can be used to can monitor network usage by application, protocol, and IP address group.
• It will monitor Cisco NetFlow, Juniper J-Flow, sFlow, Huawei NetStream, and IPFIX flow data to identify which applications and protocols are the top bandwidth consumers.
• It will collect traffic data, correlate it into a usable format, and present it on its web-based user interface
• It can help you identify which applications and categories consume the most bandwidth for better network traffic visibility and it has support for Cisco NBAR2.

The SolarWinds NetFlow Traffic Analyzer is available as an add-on to the Network Performance Monitor (NPM). Prices start at $1,915 for 100 nodes. The number of nodes you purchase must match your NPM license. If you don’t already own the NPM software, that will cost $2,995 for the same 100 nodes level. And if you want to try it before you buy it, you can download a fully functional 30-days evaluation version of either or both products,

2. PRTG Network Monitor

The PRTG Network Monitor, or simply PRTG from Paessler AG, is an all-in-one solution whose primary purpose is monitoring bandwidth utilization. As such it integrates SNMP bandwidth monitoring and NetFlow collection and analysis. But it doesn’t stop there and PRTG uses what they call sensors to monitor various systems, devices, traffic, and applications. Here’s a rundown of some of the most important monitoring technologies supported:

• Flows (like NetFlow or sFlow)
• SNMP with ready to use and custom options
• WMI and Windows Performance Counters
• SSH for Linux/Unix and macOS systems
• Packet Sniffing
• Ping, SQL and many more

Installing PRTG is easy. In fact, Paessler claims you could be done within a couple of minutes. After running the installer, the auto-discovery process will discover devices and set up basic sensors. You can then add more advanced and complex sensors—such as NetFlow collectors—manually. Should you need it, a detailed video will show you how it’s done.

PRTG runs on Windows but its user interface is web-based and can be accessed from any browser on any platform. There are also mobile apps for Android and iOS. Talking about the mobile apps, this product has a unique feature in the form of QR code labels that you can print and affix on your devices. It is then a simple matter of scanning the code from the mobile apps to quickly view the device’s sensor data.

The PRTG network monitor is available in two versions. There’s a free version that is limited to 100 sensors. Each and every monitored element counts as one sensor. For example, to monitor each port of a 48-port switch, you’ll need 48 sensors. For NetFlow collection and analysis, you’ll need one sensor for each flow exporter. For more than 100 sensors, you need a paid license. They’re available for 500, 1000, 2500, 5000, and unlimited nodes at prices varying from around $1 600 to just under $15 000. Note that the free version will allow for unlimited sensors for the first 30 days giving you a chance to thoroughly test-drive the product.

3. Scrutinizer

Scrutinizer from Plixer is an excellent NetFlow Analyzer. It’s actually much more than that many see it as a full-fledged incident response system. It has the ability to monitor different flow types such as NetFlow, J-flow, NetStream, and IPFIX, so you’re not limited to monitoring only Cisco devices.

Scrutinizer features a hierarchical design and offers a streamlined and efficient data collection. This lets one start small and easily scale way up to millions of flows per second. Scrutinizer claims to help you quickly find the real root cause of most network issues. The product can work in both physical and virtual environments and it comes with advanced reporting features.

Scrutinizer is available in four license tiers from the basic free version to the top-tier SCR level which can scale up to over ten million flows per second. The free version is limited to ten thousand flows per second and it will only keep raw flow data for 5 hours. In-between tiers are the MDX level which keeps data for 25 hours and the SSRV which keeps it forever. You can try any license tier for 30 days after which it will revert back to the free version.

4. ManageEngine NetFlow Analyzer

ManageEngine is another popular name among network administrators. The company makes some excellent tools paid as well as a few free ones. The ManageEngine NetFlow Analyzer provides a detailed view of a network’s bandwidth utilization as well as traffic patterns. It supports most flow technologies including NetFlow, IPFIX, J-flow, NetStream and a few others. The platform also boasts a web-based user interface which offers an impressive number of different views on your network. It will, for instance, let you view traffic by application, by conversation, by protocol, and several more viewing options. You can also set alerts to warn you of potential issues. You could, for instance, set a traffic threshold on a specific interface and be alerted whenever traffic exceeds it.

Much of the ManageEngine NetFlow Analyzer’s strength comes from its impressive reports. The product has several useful pre-built reports that are tailored for specific purposes such as troubleshooting, capacity planning or billing. If you’d rather have customized reports, they can easily be created.

The product’s dashboard is just as impressive as its reports. It includes several pie charts depicting top applications, top protocols or top conversations, for example. It can also display a heat map showing the status of the monitored interfaces. Dashboards can be customized to include only the information you need. For the on-the-go admins, there’s a smartphone app that will let you access the dashboard and reports from wherever you are.

The ManageEngine NetFlow Analyzer comes in two versions. The free version limits you to monitoring only two interfaces or flow exporters. For greater capacity, licenses are available in several sizes from 100 to 2500 interfaces or flows at prices varying between about $600 to over $50K plus annual maintenance fees. A free 30-day trial is available on all paid plans.

5. sFlowTrend

As we explained, NetFlow and sFlow protocols are quite different and it is rare for one tool to support both. Among all the products reviewed so far, only the PRTG Network Monitor supports the sFlow protocol. But if your network is primarily made of sFlow-enabled devices, here’s one of the best tools we could find.

sFlowTrend is an sFlow monitoring tool from inMon, the company behind the sFlow protocol. It is a basic and somewhat limited yet very capable tool. There’s a free version that will let you gather data from up to five sFlow-enabled devices and will only keep history data in RAM for up to an hour. While this could be enough to troubleshoot some networking issues, it’s not what you need for ongoing monitoring. For a more complete tool, you need to upgrade to the paid pro version which removes the number of devices limit and stores history data to disk.

The sFlowTrend dashboard provides a quick view of the current state of your network and its components. It will display top-level thresholds and interfaces with potential errors. Clicking on the sFLowTrend Network tab reveals summarized performance statistics and detailed traffic at the network or device level. Alerting thresholds can be used to receive alerts when higher-than-usual bandwidth usage is observed or network errors happen. The software also features a Root Cause tab where you can drill down on the cause of an issue such as a threshold violation.

The sFlowTrend Hosts tab is where you’ll find more detailed information about each device. It can display performance data on CPU, disk, and more, for sFlow-enabled servers. The Services tab is where you’ll find performance data for applications that export sFlow data. And on the Events tab, you’ll find a log of events such as exceeded thresholds or detected errors. Finally, the Reports tab offers several predefined reports and also supports the creation of custom reports.

sFlowTrend is written in Java and comes with both a Java-based or plain web-based user interface. It is available for Windows, Mac, and Linux. The software features an excellent online help system to assist you in configuring and using the tool.

Wrapping Up

No matter which tool you choose, network traffic analyzers will give you an invaluable insight into what goes on in your network. The tools we’ve reviewed each provide excellent value and picking one will most likely be a matter of personal preference as there might be a specific feature in one of the tools that particularly appeals to you. With all the paid tools offering either a free trial or a free version, there’s no reason why you couldn’t try a few before making a decision.