Networking Forum powered by InfoSec Insitute

I have a Cisco ASA 5510 which, by using the GUI, can give me a top IP list of senders and receivers during the last 24 hours. However I would like to automate a report every day written to a file (e.g. 2011-11-01_top10_senders.txt and _receivers.txt), so I can locate computers that sends/receives a lot of data over a period of e.g. 4 days.

I have done some scripting some years ago using rrdtool, but I wonder if anybody know a URL that have this mostly set up? RRDtool creates graphs and not lists like I seem to need now.

Any answer would greatly be appreciated.

Netflow will give you this information, just turn off displaying of graphs in whatever tool you use.

is netflow free? or is this an expensive toy?

Netflow is free.

[scottsee]

In the Cisco ASA Netflow is actually called NSEL, I believe it is available in all Appliances post version 8.2. There are several free Netflow software applications but most are not. Scrutinizer free version is a nice one, it will only store data for 24 hours, and dosen't have the configurable front page. Just make sure the tool you use is capable of registering Netflow version 9, the ASA doesn't use version 5..

if anybody would like to create a step-by-step guide for windows i would very much be interested. not detailed steps but enough to get me starting somewhere. where do i download netflow?

[ristau5741]

Configuring NetFlow on ASA with ASDM step guide

https://supportforums.cisco.com/docs/DOC-6114

How to Configure Windows nProbe to Send NetFlow ?

http://www.plixer.com/blog/netflow/how- ... d-netflow/