Recent changes to Home

Discussion for Home page

Tsepo — Wed, 13 Sep 2023 15:23:20 -0000

I need help from someone with a working Flowviewer and silk system i am struggling to graph the data but i can capture it though silk stores data in the root dir only

Discussion for Home page

Tsepo — Wed, 13 Sep 2023 15:23:19 -0000

I need help from someone with a working Flowviewer and silk system i am struggling to graph the data but i can capture it though silk stores data in the root dir only

Discussion for Home page

Martyn Noss — Sun, 30 Oct 2016 01:16:15 -0000

Hi Joe,

Thanks for the prompt reply. You've confirmed what I supposed, i.e., FlowViewer isn't designed to handle multiple timezones in a single deployment. Now that I know I'm not dealing with a configuration problem, I can turn to other strategies. Regarding using the SiLK toolset, Colorado is still using flow-tools so I'm restricted to flow-tools commands; not as powerful as SiLK, but your point remains the same. I'll rummage around in the man pages and see what I can find. Thanks again!

Marty

Discussion for Home page

Martyn Noss — Tue, 25 Oct 2016 18:13:15 -0000

Hi Joe,

Great tool!

Question: My local Flowviewer box is running in UTC. Among other netflow sources, I've recently started rsyncing a flow-tools data repository from a box in Colorado that happens to be running in MDT (UTC-6). Not a typical configuration, I realize. Does this timezone discrepancy create an insurmountable problem for Flowviewer?

Flowviewer and Flowgrapher reports pulling data from the Colorado device look reasonable (although I haven't done a detailed analysis on the actual numbers), but Flowmonitor/RRD seem not to be picking up any of the data between hours 00 and 06 UTC, resulting in obvious gaps in the daily and weekly graphs. On the theory that RRD was looking only in the flow-tools daily data directory where it expects to find the data it's looking for, and consequently not finding it for the first 6 hours of each day due to the TZ lag, I wrote a script to copy flow-tools data files for hours 18-24 of the current MDT day into the following day's directory (which I create as part of the script). The script runs immediately following completion of each rsync. This file copy seems to have more-or-less solved the Flowmonitor/RRD output problem (i.e., daily and weekly graphs now look reasonable), but I consider this strategy to be only a diagnostic exercise -- not a good operational solution.

I see in the User's Guide that FV v4.6 uses the system TZ rather than setting TZ based on configuration files. Seems reasonable, but in my case it appears to mean that Flowmonitor will necessarily mis-interpret my Colorado data (or any non-UTC data, presumably).

Any advice on how I might tackle this problem (short of asking Colorado to start using UTC)? Thanks!

Discussion for Home page

Luke Cleverley — Mon, 19 Sep 2016 05:57:02 -0000

Joe
With collector & monitor running I get the following periodic error messages:

/usr/local/www/apache24/cgi-bin/FlowViewer4.6/FlowMonitorFiles/FlowMonitorRRDtool/I.rrd
/usr/local/www/apache24/cgi-bin/FlowViewer4.6/FlowMonitorFiles/FlowMonitorRRDtool/INS.rrd

None of my monitors are called I.rrd or INS.rrd...would you have any pointers
Regards Luke

Home modified by Joe Loiacono

Joe Loiacono — Fri, 07 Nov 2014 22:15:01 -0000

--- v69
+++ v70
@@ -1,4 +1,4 @@
-<html>FlowViewer
Powered by flow-tools and SiLK
Advancing Network Traffic Situational Awareness
FAQ
+FlowViewer
Powered by flow-tools and SiLK
Advancing Network Traffic Situational Awareness
FAQ

 FlowViewer provides a dynamic web front-end to two powerful open-source netflow data collector and analyzers, Mark Fullmer’s flow-tools suite and the Carnegie Mellon NetSA group’s netflow data capture/analyzer, SiLK. The inclusion of the underlying SiLK tool set enables existing FlowViewer users to continue to use the tool with the newer IPFIX netflow data protocol.

@@ -16,5 +16,5 @@
 The FlowViewer graphing and tracking capabilities make use of such intrepid open source software as Thomas Boutrell’s gd, Lincoln Stein's GD, Martien Verbruggen's GD::Graph, and Tobias Oetiker’s RRDtool packages.

 For more information including software requirements and installation instructions, please review the FAQ, User's Guide or the README file. Or, contact me directly at jloiacon@csc.com. For somewhat larger images, please see the Screenshots.
-</html>

+

Home modified by Joe Loiacono

Joe Loiacono — Wed, 18 Sep 2013 13:16:37 -0000

--- v68
+++ v69
@@ -15,6 +15,6 @@
 The user must install and configure either flow-tools, or SiLK. Users already running FlowViewer with flow-tools may opt to install SiLK in parallel to handle IPFIX exporters while leaving older exporters in place. The ability to collect and analyze IPFIX data requires SiLK (download SiLK) now at version 3.7.1.  FlowViewer v4.0 continues to work with flow-tools for pre-IPFIX versions of netflow.
 The FlowViewer graphing and tracking capabilities make use of such intrepid open source software as Thomas Boutrell’s gd, Lincoln Stein's GD, Martien Verbruggen's GD::Graph, and Tobias Oetiker’s RRDtool packages.

-For more information including software requirements and installation instructions, please review the FAQ, User's Guide or the README file. For somewhat larger images, please see the Screenshots.
+For more information including software requirements and installation instructions, please review the FAQ, User's Guide or the README file. Or, contact me directly at jloiacon@csc.com. For somewhat larger images, please see the Screenshots.

Discussion for Home page

Joe Loiacono — Fri, 21 Jun 2013 18:10:44 -0000

But wait! No sooner do we bemoan the delay of the general public release of SiLK and presto: it's available (as of June 20, 2013)!

Download here: SiLK

Home modified by Joe Loiacono

Joe Loiacono — Fri, 21 Jun 2013 18:01:29 -0000

--- v67
+++ v68
@@ -9,14 +9,11 @@
 FlowViewer provides users with the ability to quickly extract network management information of interest from voluminous quantities of stored netflow data. The user can configure a [Dashboard] of continuously updating FlowTrackings to maintain a situational awareness of his organization's network traffic. FlowViewer consists of three primary tools: FlowViewer, FlowGrapher and FlowTracker. The user is able to filter data (inclusion or exclusion) by device, IP address range, port, router interface, autonomous system (AS), specified time interval, protocols, TOS field, TCP flags, exporter, and next-hop. All generated reports and filters can be saved for future application. The user can switch between the tools preserving the previously specified filter. FlowViewer makes flow data analysis and tracking quick and easy.

 [FlowViewer] enables the user to create text based reports from filtered netflow data. Several different reporting formats are provided. Each of these reports can be sorted by column heading.
+[FlowGrapher] enables the user to graph the bandwidth used by a filtered subset of netflow data during a specified time period. Resulting reports include the graph and a textual listing of the largest flows.
+
[FlowTracker] enables the user to maintain a long-term history of a particular traffic subset. FlowTrackings consist of five graphs of traffic over suceesive longer time periods: Daily, Weekly, Monthly, Yearly, and Last 3 Years.
 

-[FlowGrapher] enables the user to graph the bandwidth used by a filtered subset of netflow data during a specified time period. Resulting reports include the graph and a textual listing of the largest flows.
-

-[FlowTracker] enables the user to maintain a long-term history of a particular traffic subset. FlowTrackings consist of five graphs of traffic over suceesive longer time periods: Daily, Weekly, Monthly, Yearly, and Last 3 Years.
-

-The user must install and configure either flow-tools, or SiLK. Users already running FlowViewer with flow-tools may opt to install SiLK in parallel to handle IPFIX exporters while leaving older exporters in place. The ability to collect and analyze IPFIX data requires SiLK version 3.0. As of Summer 2013, SiLK v3.0 is available only to US Federal Agencies. However, it is expected to be made available to the general public soon. In the meantime, FlowViewer v4.0 continues to work with flow-tools for pre-IPFIX versions of netflow.
-

-The FlowViewer graphing and tracking capabilities make use of such intrepid open source software as Thomas Boutrell’s gd, Lincoln Stein's GD, Martien Verbruggen's GD::Graph, and Tobias Oetiker’s RRDtool packages.
+The user must install and configure either flow-tools, or SiLK. Users already running FlowViewer with flow-tools may opt to install SiLK in parallel to handle IPFIX exporters while leaving older exporters in place. The ability to collect and analyze IPFIX data requires SiLK (download SiLK) now at version 3.7.1.  FlowViewer v4.0 continues to work with flow-tools for pre-IPFIX versions of netflow.
+
The FlowViewer graphing and tracking capabilities make use of such intrepid open source software as Thomas Boutrell’s gd, Lincoln Stein's GD, Martien Verbruggen's GD::Graph, and Tobias Oetiker’s RRDtool packages.

 For more information including software requirements and installation instructions, please review the FAQ, User's Guide or the README file. For somewhat larger images, please see the Screenshots.

Home modified by Joe Loiacono

Joe Loiacono — Thu, 20 Jun 2013 13:36:41 -0000

--- v66
+++ v67
@@ -14,7 +14,7 @@
 
 [FlowTracker] enables the user to maintain a long-term history of a particular traffic subset. FlowTrackings consist of five graphs of traffic over suceesive longer time periods: Daily, Weekly, Monthly, Yearly, and Last 3 Years.
 

-The user must install and configure either flow-tools, or SiLK. Users already running FlowViewer with flow-tools may opt to install SiLK in parallel to handle IPFIX exporters while leaving older exporters in place. The ability to collect and analyze IPFIX data requires SiLK version 3.0. As of Summer 2012, SiLK v3.0 is available only to US Federal Agencies. However, it is expected to be made available to the general public soon. In the meantime, FlowViewer v4.0 continues to work with flow-tools for pre-IPFIX versions of netflow.
+The user must install and configure either flow-tools, or SiLK. Users already running FlowViewer with flow-tools may opt to install SiLK in parallel to handle IPFIX exporters while leaving older exporters in place. The ability to collect and analyze IPFIX data requires SiLK version 3.0. As of Summer 2013, SiLK v3.0 is available only to US Federal Agencies. However, it is expected to be made available to the general public soon. In the meantime, FlowViewer v4.0 continues to work with flow-tools for pre-IPFIX versions of netflow.
 

 The FlowViewer graphing and tracking capabilities make use of such intrepid open source software as Thomas Boutrell’s gd, Lincoln Stein's GD, Martien Verbruggen's GD::Graph, and Tobias Oetiker’s RRDtool packages.