IPFIX is making its own waves in more recent times when it comes to network packet collection, aggregation, and analysis, as one of Netflow's main competitors. One of the biggest and most obvious advantages of IPFIX is that it's more open-ended and vendor-friendly than NetFlow tends to be.
IPFIX essentially helps level the playing field a bit without requiring each vendor to tailor-make their own pseudo-NetFlow, or worry about potential infringement or other claims from Cisco for NetFlow use – though, to their credit, Cisco has been fairly hands off thus far with regards to the realm of NetFlow. IPFIX also allows for a wide selection of non-vendor-specific data to be collected as well, which can even be proprietary, the availability of which could sometimes be downright critical!
None the less, a vendor-agnostic option is something that almost always comes about in the world of IT, and IPFIX is just the next iteration of what may become the new norm for Flow traffic analysis and collection! Thankfully, there's already a wide range of software, from open-source and free to paid enterprise level, that will assist you in performing just that very task – snatching up all the IPFIX data it can find and presenting you with all the wonderful analytics you've come to expect from NetFlow, and more!
Top IPFIX Flow Analysis, Collection and Monitoring Tools
Grab one of these software packages below and start collecting data from your network devices today. Most have free Downloads and are easily installed on Windows systems and some are even compatible on Linux.
SolarWinds Bandwidth Analyzer Pack
SolarWinds' Bandwidth Analyzer is part of a larger package, which also includes their Network Performance Monitor – a rather powerful fool for general network traffic analysis, system management regarding up/down time, ping, etc. – but for the topic at hand, it's the Traffic Analyzer we're concerned with. It handles IPFIX collection and analysis as well as NetFlow, jFlow, sFlow, NetStream, and several others.
The analyzer focuses on a user-based approach which can track granularity down to a single minute for heavy traffic as well as store and display a variety of graphs and charts useful as much for diagnostics as analytics. The emphasis here comes in the form of the powerful and intuitive user interface and the ability to easily manipulate and view a wide variety of information from Flow data.
Download FREE 30 Day Trial Now:
nProbe is essentially an alternate version of ntop, an already well-known and highly-used application in the realm of NetFlow. nProbe offers all the same ability and functionality with the ability to handle NetFlow v5, v9, and IPFIX all in one program. It's perfect for larger networks that may have a mix of hardware or different monitoring environments, or for bringing older deprecated or legacy network environments up to speed while saving some time and money.
It can function as collector and probe alike, giving it a great deal of flexibility, and boasts a remarkable ability to operate even on high-traffic networks with very little, if any, packet loss – something that often plagues flow collection without specific tools in place to counteract it.
Price: Roughly $55-337 depending on specific license and needs, and current exchange rate (nProbe is priced in Euros.)
Plixar's offering is a pretty powerful and robust one – it may not look terrible beautiful in terms of the interface's graphic design, but the information is there, and the newer versions make it look a lot more snazzy and slick. Graphic design choices aside, it's a powerful program that pairs beautifully with their appliance offerings – which come in both hardware and VMWare versions.
With the addition of the appliances Plixar's Scrutinizer can handle over 150k flows per second from over a thousand devices, while the VMWare version can even handle 40k flows per second and a thousand devices, give or take. Considering that most purely software-based flow programs are relatively limited in how much they can collect and how fast, the appliance offerings are all but required for high-traffic or large network environments.
Plixar offers a great amount of scalability in this regard – their freeware version might be enough for a small environment just starting out, and over time it would be easy to buy a license, then begin gradually adding appliances bit by bit.
Price: Limited freeware option, trials available, licenses vary heavily depending on specific needs
IsarFlow tries to take a personalized approach, handling each acquisition of their software license with contact in an effort to specifically tailor and customize their offering to the specific needs of your network – as such, their licensing costs vary heavily and require contact.
As far as the software itself is does an excellent job collecting and handling both IPFIX and NetFlow data, and SNMP for that matter. It also facilitates heavy interface and data point customization on a per-admin basis, making it an excellent choice for individuals working together on different aspects of a network environment with individualized needs.
Price: Must contact for customized quote
Despite the name this program can also audit IPFIX data, so don't be misled! It also handles the full gambit of sFlow, jFlow, AppFlow, and NetStream, with possible support for others. It also fully handles IPv6 collection and analysis and even boasts real-time packet collection and data analysis! NetFlow Auditor even takes a more security-focused approach and provides logistic information geared towards picking out intrusion detection and security event management, too! In the same vein as security it also has a couple of tools geared towards detecting and helping to lessen the impact of DDoS attacks, port sniffing, and P2P activity that may be hard to uncover otherwise. Ultimately it has a wide range of tracking and capabilities with a handful of unique or niche features that could come in especially handy for the right environment.
Price: Free trial, licensing varies by flow per minute needed to track and must contact sales for quote
FlowViewer is really more of a front-end than a stand-alone offering, acting as a web-based interface for the eponymous duo of flow-tools and SiLK. Due to the combination of these two aspects in particular it can handle IPv6 and Cisco v9 NetFlow as well as a full range of IPFIX! Due to being open-source, and quite popular, it's also pretty darn robust especially given the total lack of up front cost. On the flip side, it lacks a lot of the more powerful and specific features, though it does have a slick interface, especially for being web-based, and provides a full range of graphing and visual representation of data while still providing all the mundane, rote line-by-line flow tables you could want. As far as basic analysis goes at no cost, there's not much better out there!
Price: Free, open-source
NetFlow and IPFIX are, in a roundabout way, kinda sorta the same thing. This would be a pretty obvious thing to those familiar with each, as they know that IPFIX is directly derived from the NetFlow v9 RFC, and at least one individual who worked on NetFlow v9 also worked on the IPFIX RFCs as well!
Generally speaking they kinda do the same thing, but there's some definite nuances – IPFIX makes a few nitpicky sorts of adjustments to some terminology and labeling, but generally is just a bit more expansive and refined than NetFlow and offers some bits of customization and modularity, to a degree.. unless, of course, we take into account Flexible NetFlow, but that's neither here nor there.
Proper monitoring and gathering of information for thorough diagnostics and analysis is critical for maintaining a robust and healthy network environment. Continuous tracking of traffic tendencies can help enormously in preventing downtime and provide remarkable foresight in regards to future scaling needs.
More importantly though IPFIX, much like its NetFlow counterpart, offers a wide berth more than just basic data, and can let you dig down into the most granular aspect and tidbit about the packets traversing your network that there's simply almost no problem too sneaky and small for it to help you ferret out! Add to that the flexibility of being able to customize some of the IPFIX fields and you've got a powerful option that can even be tailor-fit to your needs.
Grab one of the Listed IPFIX Collector and Analyzers from above and take back your network bandwidth by finding high bandwidth users and more.