How to get network usage statistics

[dj_farid]

I have a network with a few HP 3400cl switches among others. These switches supports sFlow.
I would like to gather some statistics about the network usage on my internal LAN, where these switches live.
I would like to be able to tell how much of the traffic is broadcast, multicast, TCP, HTTP...
Some graphs showing this during different hours of the day would be nice.
What options do I have to accomplish this, and how would I do it?
I have had a look at ProCurve Manager+. I didn't get the impression that it is able to do this.
I have read about sflow on sflow.org, but couldn't find anything specific for these switches.
Any comments are welcome.

[Matt Hobbs]

PCM+ can do this, but only for the last hour worth of traffic. (I think the upcoming version will give you 3 hours of history).

A more powerful software solution is InMon Traffic Sentinel which will give you much more historical data.

These applications will automatically configure sFlow for you, all you need to provide is the correct SNMP community strings.

[dj_farid]

Thanks for the answer!
Does anyone know any open source/free ways of doing this?

What about the InMon: sFlowTrend, it seems to be able to do what I am looking for. I will try it out.

how is sFlow enabled in these switches? Does the software you use to get sFlow use SNMP SET? In other words, do I need to set up a SNMP write community?
If so, How would I deploy this securely so that the community string is not sent in clear text?

[Steve Britt]

DJ,

PCM+ 2.2, which will be available starting on June 1, will keep 12 hours of traffic data from each port. The data is near-real-time, meaning that it's reported each minute for each monitored port. You can specify which ports you want to sample on (using sFlow) and which you want simple statistics gathering on, or you can just let PCM+ determine which type of data acquisition to apply to each port on its own. On each port where you're sampling you can see 10 top talker lists that tell you about connections, sources, destinations, and protocols on those ports.

In addition PCM+ 2.2 has a logging mode that allows it to record traffic data on demand. This mode can also be triggered by threshold violations, so that if "interesting" traffic happens at a time which is outside the 12-hour window retained by the time you're able to inspect it, the data pertaining to the threshold violation is still accessible.

Regards,

SVB

[Matt Hobbs]

sFlowTrend and Scrutinizer have free versions but are limited in their functionality.

http://www.plixer.com/products/scrutinizer.php
http://www.inmon.com/products/sFlowTrend.php

You will need SNMP write access, to secure it you will need to use SNMPv3 - I'm not sure if these applications support that though.

[dj_farid]

Thanks for the answers!
I will look at the manuals for sFlowTrend and Scrutinizer. I noticed earler that InMon has some really good and useful documentation that explains the sFlow functionality in ProCurve switches quite good.

I think that PCM+ is a little bit too expensive to get only for sFlow support. However I will probably try the 30 day free trial when the new version is out. Maybe there is something else in the package that justifies buying it.

Apparently ntop http://www.ntop.org/overview.html should be able to do what I want as well. Has anyone managed to configure it to work with ProCurve 3400cl's?

[daniel wright_1]

i use cacti (free), it can be made to poll as often as you like and there is a mod on th cacti forums to make the graphs show one minute averages.

its very flexible and we use it to monitor everything including server cpu / ram / drive usage, network usage / errors, ups load / input / temp etc its a very useful application

[dj_farid]

Daniel, I didn't know that Cacti supports sFlow. Did you install some kind of plugin for it to work? I can't find anything on the Cacti homepage for sFlow. I found a thread in the forums requesting a sFlow plugin though.

[daniel wright_1]

I use SNMP to collect the interface usage statistics through cacti.

i dont know too much about how sFlow works but i should image it would be possible to get it working in Cacti (will probably be a fair amount of work though.

[dj_farid]

sFlow would probably give more information than what you get now.
I don't think it would be impossible to get sFlow to work with Cacti. I am not a programmer though. So I will have to wait until someone else makes a plugin that works for it.