Im wondering what people recommend software wise for bandwidth accounting (ie a graphical front end for netflow) other than cisco's own netflow tool

not wanting to graph the results (like cacti) but rather account the daily usage via routers on a per IP and or per switch port basis

I've heard good things about Ubersmith as an enterprise-level product, though I've not used it myself.

im actually looking at just bandwidth accounting/tracking not a billing solution

In that case... How about something like http://www.rzk.com/products/netreport.stm

Snowman,

What netflow version?

For small-medium (couple of GB per day) take a look at ntop (http://www.ntop.org/). This works quite well provided you aren't smashing it. Another one is Flowscan (http://www.caida.org/tools/utilities/flowscan/), same deal applies.

Other collector tools which can handle heavy amounts of netflow (we do about 40GB+ per day at the moment) take a squiz at Flow-tools (http://www.splintered.net/sw/flow-tools/), cflowd (http://www.caida.org/tools/measurement/cflowd/), IPCad (http://lionet.info/ipcad/), Flowd (http://www.mindrot.org/projects/flowd/) and Softflowd (http://www.mindrot.org/projects/softflowd/).

Freshmeat has a bunch of others too: http://freshmeat.net/search/?q=netfl...ts&Go.x=&Go.y=

Hope that helps.

Stu

Stu

thanks ive looked already at ntop, pity it wont cope with the traffic levels i think we will have to go with flow-tools i will just need to work out and code up a front end for it

Umm,

Define 'traffic levels' mate.

I specified those values in 'raw netflow'. 40GB translates to ~400mbit constant.

Stu

Ah well that makes a bit of a difference.

doing 200Gb a day in/out per day or thereabouts for this particular setup

Well, it really depends on what sort of network noise your situation has but 200GB per day is about 3Mbit constant. It's unlikely you'd be breaking more than a few GB a day in netflow records.

Key thing to remember is that netflow produces one line per connection. That means if you have random port scans of about 20 bytes the netflow record itself is actually larger than the connection itself. On the flipside, one 100MB download from a webserver represents exactly the same size in netflow output.

Stu