Webview Netflow Reporter

Table of contents

Overview

Webview Netflow Reporter is an enterprise-focused Netflow reporter/analyzer tool featuring clickable graphs, powerful categorization that goes beyond simple TCP/UDP port names, automatic exporter discovery, and full access to all aspects of the raw flow data (interface names, millisecond accuracy, QoS settings, TCP flags, etc). Webview installs on a Linux is accessed via a web browser.

In a typical setup, Netflow data is constantly categorized and tracked on each router/switch interface. The web user selects one or more interfaces and can view a graph of average or/or peak traffic utilization for each category over the past hour, day, week, etc (see sample screenshots below). The user can also run ad hoc reports over any time period to explore all aspects of the traffic, such as a top talkers IP address report or a raw flow chronology.

Download

New features in 2013 (version wvnetflow-1.07)

Key features

Uses of this application that may not be immediately apparent

Limitations and comparison with other packages

For those comparison-shopping the open source tools, I'll state up-front some of Webview Netflow Reporter limitations:

System Requirements

Webview runs on a physical or virtual Linux host.

If you will be collecting netflow on fewer than 5 routers with a total of less than 200 Mbps of traffic, then sizing should not be a concern. Go ahead and install Webview on a virtual machine with one vCPU, 512MB RAM, and 40-250GB of disk, and see how it goes.

If you will be collecting much more flow data, then you need to consider other factors:

  1. Flow exporter count -- how many devices will be sending flows?
  2. Flow exporter interfaces -- how many total interfaces will be represented in the flow data?
  3. Flow export rate -- what is the total volume of flow data (measured in flows/second)?
  4. Raw flow storage -- how many days/weeks of raw flow data should be kept online for ad hoc reporting?
  5. Traffic category count -- how many different types of traffic categories will be identified (including both general categories like video, web, and email and any more detailed categories like "untagged g.711 audio" and "fred's development server")
  6. Resolution and history of aggregated data -- how much history is to be stored at 1-minute sampling, 5-minute sampling, 60-minute sampling, and 24-hour sampling.
Here are some general guidelines:

History and author

The Webview Netflow package was primarily written by Craig Weinhold (craig.weinhold@cdw.com), a Cisco network engineer and CCIE. This software has been developed to address real-world needs in medium and large-size enterprise networks that the author has worked with over the years. This GPL'ing of this software was supported by the author's employer, CDW, a company that not only moves a lot of boxes through its warehouses, but also provides top-notch IT professional services around Cisco, Microsoft, IBM, NetApp, EMC, and other vendors. Our specialties include unified communications, security, data center, WAN, storage, and systems. Not surprisingly, CDW would be happy to help you with enterprise Netflow design and planning services, including the support of Webview Netflow Reporter. For more information on these commercial services, consult the Contact us page at http://www.cdw.com/content/services/professional-services.aspx.
Sourceforge.net project site
last updated: 16-June-2013