Bandwidth Monitoring - NetFlow or SNMP or maybe both ?

Talk about bandwidth monitoring and the next question is how to. You have three options - Packet Sniffing (Packet Analysis), SNMP and NetFlow. When it comes to traffic analysis, the main choices are always packet sniffing and NetFlow and we talked about this in our last blog. Now with general bandwidth monitoring, it is mainly SNMP and NetFlow. Which one do we go with now?

SNMP based network monitoring tools can give information on the Tx and Rx (Transmit and Receive) traffic in your network. SNMP based information is not in depth, but can be used on almost any SNMP supported network device. It can give information on the byte count or the bits per second count for each interface from your router or switch and thus help in a getting a clear picture on interface was traffic details. This information gives you a good idea on which link is being over utilized or has congestions during peak hours. This information is good enough for making capacity planning decisions in your network.

Now, you may have quite a number of unwanted applications using the available bandwidth thus causing link overloading. SNMP will not be able to retrieve information on the applications used, the hosts involved in traffic and so on. So, most of your important questions like who used the bandwidth and where did all the traffic go is left unanswered. NetFlow data can give information on applications used, source and destination of traffic, conversations and etc. Moreover, unlike SNMP, which is based on pull technology where the monitoring tool has to pull data from the device MIB, NetFlow is based on PUSH technology and so the information is shown as soon as it is created by setting appropriate flow export time.