Page 2 - Contents
User’s Guide – version 3.5 NetFlow Tracker 2 Contents SOFTWARE LICENSE AGREEMENT 5 INTRODUCTION 15 What is NetFlow? 15 What is NetFlow Tracker? 15 Features and Benefits 15 INSTALLATION 17 Minimum System Requirements 17 Operating System Support 17 Pre-installation Checks 17 Installation on Microsoft ...
Page 5 - Software License Agreement; GRANT OF LICENCE AND PAYMENT OF FEES; EVALUATION, UPDATES, UPGRADES AND SUPPORT AND MAINTENANCE
User’s Guide – version 3.5 NetFlow Tracker 5 Software License Agreement This is a legal agreement between you (“You”/ “the End User””), and Fluke Corporation, a Washington corporation, its subsidiaries and affiliates, including Fluke Networks (“Fluke”), with offices at 6920 Seaway Boulevard, Everett...
Page 6 - RESTRICTIONS
User’s Guide – version 3.5 NetFlow Tracker 6 If You have purchased the maintenance and support services from Fluke then subject to payment of the support fees, Fluke shall provide such services in respect of the Product in accordance with the provisions of the Support and Maintenance Agreement conta...
Page 7 - CUSTOMER REMEDIES; NO LIABILITY FOR CONSEQUENTIAL DAMAGES
User’s Guide – version 3.5 NetFlow Tracker 7 6. CUSTOMER REMEDIES You must call your Fluke representative for an authorization to return any item during the 90 day warranty period referred to in clause 5 above, and You will be supplied with a return authorisation number and an address for returning ...
Page 8 - CONFIDENTIAL INFORMATION AND SECURITY
User’s Guide – version 3.5 NetFlow Tracker 8 11. CONFIDENTIAL INFORMATION AND SECURITY During and after this Agreement, the Parties will keep in confidence and use only for the purposes of this Agreement all Confidential Information. Confidential Information means information belonging or relating t...
Page 10 - Appendix 1 to End User Licence
User’s Guide – version 3.5 NetFlow Tracker 10 Appendix 1 to End User Licence Terms and Conditions for Fluke Support and Maintenance Service 1. Definitions 1.1 In this Agreement and in the Schedules hereto, save where the context so admits or requires, the following definitions shall have the followi...
Page 11 - Services; Charges; Supplier’s Undertakings
User’s Guide – version 3.5 NetFlow Tracker 11 1.7 The contents of the Schedule form an integral part of this Agreement and shall have as full effect as if it were incorporated in the body of this Agreement and the expressions “this Agreement” and “the Agreement” used in the Schedule shall mean this ...
Page 12 - Limitation of Liability and indemnity; Property
User’s Guide – version 3.5 NetFlow Tracker 12 5.4 Without prejudice to the generality of clause 5.3 and for the avoidance of doubt, to the fullest extent permitted by law all terms implied by Sections 13, 14 and 15 of the Sale of Goods Act, 1893 are hereby excluded and all terms implied by the Sale ...
Page 13 - Confidential Information and Security; 0 Miscellaneous
User’s Guide – version 3.5 NetFlow Tracker 13 9. Confidential Information and Security 9.1 During and after this Agreement, the Parties will keep in confidence and use only for the purposes of this Agreement all Confidential Information. Confidential Information means information belonging or relati...
Page 14 - Schedule; Support Hours
User’s Guide – version 3.5 NetFlow Tracker 14 Schedule Support Services 1. Support Hours The Support Hours during which Fluke shall supply the Support Services shall be between 9.30am and 5pm on Working Days. 2. Support Services Fluke shall provide You during the Support Hours with: 2.1. technical a...
Page 15 - Introduction; What is NetFlow Tracker?
User’s Guide – version 3.5 NetFlow Tracker 15 Introduction This document is the user manual for NetFlow Tracker, a software product designed to collect NetFlow information from Cisco equipment and present it in a meaningful way. This document does not provide any assistance with Cisco equipment itse...
Page 16 - as simplified HTML or PDF for printing or emailing.
User’s Guide – version 3.5 NetFlow Tracker 16 • Every report and chart can be formatted as CSV or XML for further processing or as simplified HTML or PDF for printing or emailing. • Straightforward URL format for linking current, automatically updated charts into other applications. • Optimized data...
Page 17 - Installation; Minimum System Requirements
User’s Guide – version 3.5 NetFlow Tracker 17 Installation Minimum System Requirements The type of system required to run NetFlow Tracker depends on the number of devices sending NetFlow information to it and the amount and nature of traffic handled by those devices. The following requirements are a...
Page 18 - installation if you wish.; Installation on Microsoft Windows; accept the default choices and continue.
User’s Guide – version 3.5 NetFlow Tracker 18 • NetFlow Tracker contains an embedded web server. Web servers normally run on port 80, but this may be in use by another web server on your system. You can choose a different port during installation or disable other web servers prior to installation if...
Page 19 - “NetFlow Tracker” in the Programs section of your start menu.; Installation on Linux; 0 if you didn’t choose a port.
User’s Guide – version 3.5 NetFlow Tracker 19 Custom Setup You will only see this dialog if you chose custom setup above. You should see options for NetFlow Tracker and MySQL, unless an unsupported version of MySQL was detected. To change the install folder for either NetFlow Tracker or MySQL, click...
Page 20 - Set up SNMP community strings
User’s Guide – version 3.5 NetFlow Tracker 20 Set up SNMP community strings If any of the devices you intend monitoring do not use a read-only SNMP community of “public” you will need to add their communities to the list in SNMP Settings . Add listener ports If you intend monitoring more than one de...
Page 21 - Using NetFlow Tracker; Executive Reports
User’s Guide – version 3.5 NetFlow Tracker 21 Using NetFlow Tracker Once you have installed NetFlow Tracker and configured your devices, data will be available within a few minutes. There are many ways to access this data. Real-time Data NetFlow Tracker stores up to fourteen days full NetFlow data w...
Page 22 - Device traffic meters
User’s Guide – version 3.5 NetFlow Tracker 22 Device traffic meters In addition to the orderable columns there are two graphical meter columns that allow you to instantly see which devices are currently busy. Each chart shows you the recent peak and the current rate: Each chart is scaled relative to...
Page 23 - Filter Editor; Working with Charts; Report Settings
User’s Guide – version 3.5 NetFlow Tracker 23 Per-AS data If your router uses BGP to route traffic it will provide source and destination origin or peer AS numbers in its NetFlow data. NetFlow Tracker creates optimised bi-directional charts for each AS just as it does for each interface. An AS chart...
Page 25 - Creating Filtered Reports
User’s Guide – version 3.5 NetFlow Tracker 25 Alter the filter applied to a standard chart Most charts allow you to change the applied filter by click the filter editor toolbar button: See Creating Filtered Reports for more about the filter editor. View resolved domain names If a chart shows IP addr...
Page 26 - Working with Pie Charts; Working with Tabular Reports; Most
User’s Guide – version 3.5 NetFlow Tracker 26 Working with Pie Charts Most charts can be displayed instead as a pie chart. Rather than breaking the selected time range into small chunks and charting each one, a pie chart shows each of the top element’s proportion of the total octets or packets durin...
Page 27 - Sort a tabular report
User’s Guide – version 3.5 NetFlow Tracker 27 Sort a tabular report A report can be sorted on any of the columns describing the reported elements, or can be sorted by traffic or packet rate. Simply click the column heading – if you click a column heading twice it will be sorted in the opposite order...
Page 28 - Report Templates; Address Reports
User’s Guide – version 3.5 NetFlow Tracker 28 Report Templates Whenever you create a new tabular report or chart you can choose any of the standard report templates depending on what you want to examine: Address Reports • Source Addresses – shows the IP addresses that were the source of most traffic...
Page 29 - QoS Reports
User’s Guide – version 3.5 NetFlow Tracker 29 • Bi-directional Conversations – adds extra columns showing the traffic and packets sent from destination to source and the bi-directional totals for each conversation. • Source Endpoints – shows the IP addresses and corresponding applications that were ...
Page 30 - Interface Reports; you can add a filter to the page by selecting it and clicking “Add”.
User’s Guide – version 3.5 NetFlow Tracker 30 • Networks – shows the IP subnets that were the source or destination of the most traffic or packets. • Network Pairs – shows the pairs of connected IP subnets that exchanged most traffic or packets. • Bi-directional Network Pairs – adds extra columns sh...
Page 31 - Report
User’s Guide – version 3.5 NetFlow Tracker 31 Some filters allow a range of items to be added; in this case enter the start and end of the range in the boxes provided. To select a single item, leave the right-hand box empty, If you are logged in as an administrator or not logged in you can save a fi...
Page 32 - Device Settings
User’s Guide – version 3.5 NetFlow Tracker 32 Time zone You can change the time zone used to interpret the start and end times and time masks from the default of the time zone used by the NetFlow Tracker server. Source device You must select which router or switch you want to consider. If you need t...
Page 33 - IP Application Names
User’s Guide – version 3.5 NetFlow Tracker 33 Protocol You can restrict the set of IP protocols considered. For example, you may want to consider only UDP or ICMP traffic while investigating a denial-of-service attack. Source port The source port filter restricts the source application port number; ...
Page 34 - origin or peer AS depends on the configuration of the router (see
User’s Guide – version 3.5 NetFlow Tracker 34 DiffServ This will select only traffic bearing one of the selected differentiated service code points. Since DiffServ and ToS use the same field in the IP header you should not use both filters at the same time. You can assign a name to a code point usin...
Page 35 - Devices and Interfaces
User’s Guide – version 3.5 NetFlow Tracker 35 Long-term Reports Long-term reports allow you to look at data over much longer time ranges than is possible with the standard real-time database. The data for long-term reports is summarized in advance so a long-term report over several days or weeks can...
Page 36 - Filter
User’s Guide – version 3.5 NetFlow Tracker 36 If you select a per-device, per-inbound interface or per-outbound interface report you must also specify what device or interface to report upon. The editors for selecting a device or interface are slightly different to their counterparts in the real-tim...
Page 37 - Reports; page and to allow quick access to commonly-used reports.
User’s Guide – version 3.5 NetFlow Tracker 37 Reports The “Reports” menu on the NetFlow Tracker homepage contains links to user-defined executive and scheduled reports. An executive report is a pre-defined template that contains one or more charts or tabular reports. Executive reports can be created...
Page 38 - Report URL Format; General Form; server; Report Format Parameters; templid; report template; cid
User’s Guide – version 3.5 NetFlow Tracker 38 Report URL Format You can easily generate your own URLs or modify automatically created ones for use in network management portals favourites lists. General Form http://<server>:<port>/report.jsp?prm=value&prm=value... server The domain n...
Page 39 - executive report
User’s Guide – version 3.5 NetFlow Tracker 39 0023 Next Hops 0024 Source Address Dissemination 0025 Destination Address Popularity 0026 Recognised Applications 0027 Traffic Classes 0028 Identified Applications 0029 Bi-directional Address Pairs 0030 Bi-directional Conversations 0031 Bi-directional AS...
Page 41 - sections
User’s Guide – version 3.5 NetFlow Tracker 41 sections – specifies the report sections to output. The sections, formed by summing the values for each section 1 Title 2 Time range & filter description 4 Main report or chart body 8 Chart title, if applicable 16 Chart legend, if applicable <sect...
Page 42 - Time Range Parameters; Start and end time
User’s Guide – version 3.5 NetFlow Tracker 42 format – specifies the output format of the report or chart. html Fully interactive HTML (default) print Printable/saveable HTML pdf PDF csv Comma separated values xml XML reload – specifies the number of seconds between automatic refreshes of the report...
Page 43 - Fixed length
User’s Guide – version 3.5 NetFlow Tracker 43 etime – specifies the end of the required time range. <time> The time in milliseconds UTC <dd>/<MM>/<yyyy>%20<HH>:<mm> The time, with <dd> being the date, <MM> the month, <yyyy> the year, %20 a URL- e...
Page 45 - Applying a time-of-day mask to the time range
User’s Guide – version 3.5 NetFlow Tracker 45 edate_nunitsago – (optional) specifies the number of units before the time of report generation of the last day of the time range. 0 The last day of the time range will be the first day of the unit following the current unit at the time of report generat...
Page 46 - Specifying a time zone; timezone; – specifies the time zone of the report.
User’s Guide – version 3.5 NetFlow Tracker 46 Specifying a time zone By default the time zone used to interpret calendar-based time ranges and time-of-day masks is the time zone of the NetFlow Tracker server. You can specify a non-default time zone if you wish. Note that if a long-term report has a ...
Page 48 - Specifying the chart sample size
User’s Guide – version 3.5 NetFlow Tracker 48 285 (GMT+12:00) Fiji, Kamchatka, Marshall Is. 300 (GMT+13:00) Nuku'alofa Specifying the chart sample size When you create a real-time chart the system chooses a sample size that will create as close to 150 samples over the full width of the chart as poss...
Page 49 - Filter Parameters; saved filter
User’s Guide – version 3.5 NetFlow Tracker 49 sample – specifies the source long-term data to use 10minute Daily data (ten minute samples) will be used 1hour Weekly data (one hour samples) will be used 6hour Monthly data (six hour samples) will be used 12hour Quarterly data (twelve hour samples) wil...
Page 51 - grouped application
User’s Guide – version 3.5 NetFlow Tracker 51 dstport – specifies an acceptable destination application port number. Format as for srcport above. dstport_exclude=true – specifies that the supplied destination application port numbers are excluded rather than included. srcappl – specifies an acceptab...
Page 54 - nexthop; Security Parameters
User’s Guide – version 3.5 NetFlow Tracker 54 nexthop – specifies a next-hop address. <addr> The address in dotted-decimal format <addr1>-<addr2> A range of addresses, with <addr1> being the start of the range and <addr2> the end nexthop_exclude=true – specifies that th...
Page 55 - Management Portal Access Control Parameters
User’s Guide – version 3.5 NetFlow Tracker 55 Management Portal Access Control Parameters The following parameters are used by a management portal that provides users with access to NetFlow Tracker reports as described in Management Portal Settings . portalsecret – specifies the secret value assigne...
Page 56 - aclsf; aclfeatures
User’s Guide – version 3.5 NetFlow Tracker 56 6 Out Interface 7 In/Out Interface 8 Protocol 9 Source Port 10 Dest Port 11 Src/Dest Port 12 Source Application 13 Dest Application 14 Src/Dest Application 15 ToS 16 DiffServ 17 Source AS 18 Dest AS 19 Src/Dest AS 20 Source Subnet 21 Dest Subnet 22 Src/D...
Page 58 - Performance Tuning; Disk Speed; you have a fast disk subsystem or lots of RAM, or both. See
User’s Guide – version 3.5 NetFlow Tracker 58 Performance Tuning There are several factors that influence how quickly a given report is generated: Disk Speed The first step in creating a report is reading the raw data from disk; increasing the speed of the disk subsystem will make reporting faster. ...
Page 59 - Configuration Guide; cause changes to be lost.; Licensing; “Ok” to use the new licence.; Listener Ports; missed flows; SNMP Settings; unlikely you will need to alter these.
User’s Guide – version 3.5 NetFlow Tracker 59 Configuration Guide To open any of the settings pages, click “Settings” on the main page. If you have password protection enabled you may have to login as an administrative user to see the link. Each settings page controls a single aspect of the software...
Page 60 - Device List
User’s Guide – version 3.5 NetFlow Tracker 60 Device Settings Device List This page allows you to check the status of a known device and override the interface descriptions and speeds obtained from it. The name and address of each known device is listed, along with an icon indicating its status; an ...
Page 61 - Sampled Data Scaling
User’s Guide – version 3.5 NetFlow Tracker 61 A device may be configurable to send the BGP next-hop address in its NetFlow exports; if this is the case you will have the option to store this value in place of the IP next-hop for the device. Sampled Data Scaling If a device performs packet sampling t...
Page 62 - interface status report; Security Settings; Network
User’s Guide – version 3.5 NetFlow Tracker 62 If you wish to prevent interfaces that never report any NetFlow data from appearing in the interface status report and Filter Editor check the box corresponding to the interface in the “inactive” column. If the configuration of the device has changed the...
Page 63 - Management Portal Settings; password protected
User’s Guide – version 3.5 NetFlow Tracker 63 You can use your own html page if you wish by putting it in the “customweb” folder under the NetFlow Tracker install folder; it is then available from the NetFlow Tracker server as, for example, http://server/customweb/file.html, so the homepage would be...
Page 64 - Using Apache as a Portal Server; RewriteEngine On
User’s Guide – version 3.5 NetFlow Tracker 64 Using Apache as a Portal Server The Apache web server supports several directives in its configuration file ( httpd.conf ) that allow it to be used as a programmable proxy server: RewriteEngine On This enables the URL rewriting module. RewriteRule ^/trac...
Page 65 - General Settings
User’s Guide – version 3.5 NetFlow Tracker 65 Report Settings This page lets you configure various values affecting the way reports and charts appear in NetFlow Tracker. General Settings • Show hostnames in reports controls whether reports and charts are opened with all resolvable hostnames resolved...
Page 66 - Saved Filters
User’s Guide – version 3.5 NetFlow Tracker 66 Saved Filters Saved filters can be defined that can be added wherever a filter editor appears in the software. A saved filter allows you to attach a name to, for example, a time-of-day mask or a filter that selects traffic related to a particular multi-p...
Page 69 - and
User’s Guide – version 3.5 NetFlow Tracker 69 A HTML cell has a CSS style that is used to control its appearance. Three standard styles are offered – “Report Title” produces a cell that looks exactly like a report title, “Report Description” one with the blue background of a report’s time range and ...
Page 70 - Content; nelements
User’s Guide – version 3.5 NetFlow Tracker 70 An Example Executive Report – Top Applications Today and This Week This report contains two sub reports, one showing top applications for a device over the last 24 hours and the other over 7 days. The reports are shown as pie and time charts, and HTML ce...
Page 71 - cell cover two columns.
User’s Guide – version 3.5 NetFlow Tracker 71 The fourth row consists of a single sub-report cell containing the chart legend for the first sub-report. No interactive controls are supported. Simply select “Today” as the report, “Legend” as the only section, and deselect all controls. Don’t forget to...
Page 72 - of IP addresses, a range of port numbers for a given protocol, a; DiffServ Names
User’s Guide – version 3.5 NetFlow Tracker 72 IP Application Names NetFlow Tracker receives application information in the form of a protocol number and port number. These correspond directly to specific network applications. Many are predefined (well-known ports) while others (registered ports) are...
Page 73 - AS Names; amounts of data may take considerably longer to run.
User’s Guide – version 3.5 NetFlow Tracker 73 AS Names This page lets you assign names to AS numbers appearing in reports. AS numbers below 34816 are assigned by several agencies; NetFlow Tracker comes with many of these ASes already named. Numbers between 34816 and 64511 are held by the IANA and sh...
Page 74 - time range is chosen.; Backup; locations on alternate days.
User’s Guide – version 3.5 NetFlow Tracker 74 • Store real-time data for allows you to change the number of days full real-time data is stored for. You can reduce this to save disk space, or increase it if you are sure you have enough free space. • Store 10 minute, 1hour, etc. long-term data for all...
Page 75 - Archiving; Database Settings; Memory Settings; Average sample storage duration
User’s Guide – version 3.5 NetFlow Tracker 75 Archiving NetFlow Tracker can be configured to archive real-time data older than the age configured in Database Settings to a nominated location rather than delete it. Archiving is enabled for a device in Device Settings ; the archiving settings page all...
Page 76 - Appendix 1
User’s Guide – version 3.5 NetFlow Tracker 76 NetFlow Data Received This counter shows the number of exports and the amount of NetFlow data received by the software from each device. Note that this is not the amount of traffic described by the exports but the LAN traffic generated by the exports the...
Page 77 - No In Interface; About; help diagnose a problem.
User’s Guide – version 3.5 NetFlow Tracker 77 No In Interface If flows arrive with no in interface it may indicate a configuration problem on a Catalyst switch. Please contact technical support. About The about page shows a summary of information about what versions of NetFlow Tracker, Java, MySQL a...
Page 78 - Appendix 1: Device Configuration; Enabling NetFlow Export/NDE on a Cisco Router or Layer 3; CatOS; ip cef; ip flow-export source loopback 0
User’s Guide – version 3.5 NetFlow Tracker 78 Appendix 1: Device Configuration This is a brief guide to setting up NetFlow on various types of device. Note that if your device isn’t listed here it does not mean it is not supported by NetFlow Tracker; please ask your device vendor for a guide to enab...
Page 79 - ip flow ingress; input filters
User’s Guide – version 3.5 NetFlow Tracker 79 ip flow-cache timeout active 1 This breaks up long-lived flows into one-minute segments. ip flow-cache timeout inactive 15 This ensures that flows that have finished are exported in a timely manner. interface <interface> ip route-cache flow or ip f...
Page 80 - Enabling NetFlow Export on a 4000 Series Switch; ip; Enabling NDE on a Native IOS Device
User’s Guide – version 3.5 NetFlow Tracker 80 Enabling NetFlow Export on a 4000 Series Switch The 4000 and 4500 series switches require a Supervisor IV with a NetFlow Services daughter card (WS-F4531), or a Supervisor V, and IOS version 12.1(19)EW or above to support NetFlow. First configure the dev...
Page 81 - mls flow ip interface-full; or; mls flow ip full; earlier IOS version on the Supervisor Engine 2 or 720.
User’s Guide – version 3.5 NetFlow Tracker 81 mls flow ip interface-full mls nde interface or mls flow ip full If you have a Supervisor Engine 2 or 720 running IOS version 12.1.13(E) or higher the first two commands are required to put interface and routing information into the NetFlow Exports. This...
Page 82 - Configuring NDE on a CatOS Device
User’s Guide – version 3.5 NetFlow Tracker 82 Configuring NDE on a CatOS Device A layer 3 switch running CatOS appears as two devices; the MSFC can be configured to export NetFlow information on all the packets it routes by following the instructions for configuring an IOS device above. In privilege...
Page 83 - Configuring NetFlow Input Filters for Traffic Class Reporting; Create a flow sampler that exports every flow record.; Enabling Flow Detail Records on a Packeteer Device; Tracker. For more information visit
User’s Guide – version 3.5 NetFlow Tracker 83 Configuring NetFlow Input Filters for Traffic Class Reporting IOS versions 12.2(25)S, 12.2(27)SBC and 12.3(4)T and greater support the NetFlow Input Filters feature, which can be used by NetFlow Tracker to report upon the traffic class used to route each...
Page 84 - Enabling NetFlow on an Enterasys Device; set netflow cache enable; set netflow export-interval 1
User’s Guide – version 3.5 NetFlow Tracker 84 To ensure that NetFlow Tracker receives enough information from the device you must ensure that the “Look Community String” configured in the “SNMP” page is one of those set up in SNMP Settings , and you must set “Packeteer-0 Packets” to “on” in the “sys...
Page 85 - Appendix 2: CSV File Format; Chart CSV format; Pie chart CSV format; second is the time range and filter.
User’s Guide – version 3.5 NetFlow Tracker 85 Appendix 2: CSV File Format Every standard chart and tabular report can be converted to comma-separated-value format for importing into a database server or spreadsheet. Chart CSV format Each section is separated by a row of “=” signs. The first section ...
Page 86 - Appendix 3: XML Format; xml; subfolder underneath the folder; Chart XML format; of each column in the report any column totals are included here.
User’s Guide – version 3.5 NetFlow Tracker 86 Appendix 3: XML Format Every standard chart and tabular report can be converted to XML for use in external software. The XML schemas are provided in the xml subfolder underneath the folder where NetFlow Tracker is installed. The root of each XML document...
Page 87 - Appendix 4: Third Party Software Components
User’s Guide – version 3.5 NetFlow Tracker 87 Appendix 4: Third Party Software Components This product includes software developed by the Apache Software Foundation ( http://www.apache.org/ ). This product includes software developed by Advantys ( http://www.advantys.com ). Apache Commons Collection...
Page 88 - jspSmartUpload
User’s Guide – version 3.5 NetFlow Tracker 88 jspSmartUpload NetFlow Tracker includes jspSmartUpload 2.1 which is no longer available. This is distributed under the Advantys Freeware license contract, a copy of which is available at http://web.archive.org/web/20031209160524/http://www.jspsmart.com/l...
