Looking for a network monitoring software

patpro

patpro

Hello,

Is there a software, available on FreeBSD, that would produce a nice dashboard of network usage, including top destinations by data or packets across a period of time, top protocols, etc. ?
 
Thank you all,

I’ve tested ntopng. Very good software, but a real resource hog. And monitoring (at least) 4x 1Gbps eth if, is intense on the I/O side. Not sure I want to erode my NVMe drives with that.
Grafana: not a fan at all, and needs a process to fetch data for you, needs work to create the dashboard, etc.

I might give a try to darkstat.
HTTP proxies on the other hand fail to monitor the network, they just see a small fraction of protocols. That would not work for me.
 
if your networking gear supports netflow you could also take a look at nfsen-ng (https://github.com/mbolli/nfsen-ng). There's also net-mgmt/nfsen but it is quite old and had various problems last time I tried to get it running.

regarding resource usage: network monitoring *is* quite resource intensive. collecting netflow data from a bunch of switches is like drinking from a firehose. You absolutely need to filter/tune the amount, interval and type of data you are actually store/process/visualize.
 
patpro said:
I’ve tested ntopng. Very good software, but a real resource hog. And monitoring (at least) 4x 1Gbps eth if, is intense on the I/O side. Not sure I want to erode my NVMe drives with that.
Grafana: not a fan at all, and needs a ….
Click to expand...

That’s the thing. If you want realtime monitoring you need strong hardware. Lot of data coming in fast.

Another way is aggregated data like the ELK stack. This means shipping logfiles to a server for analysis and reports.

Darkstat is a quick overview of datavolumes but has nothing on protocols or anything deeper.

Back in the days there were some tools based on SNMP and MRTG like net-mgmt/cacti that are collecting in time based intervals giving you averages over time to analyze. Those tools use very little hardware and that is where Grafana can be used today as a more modern looking tool. For quick per machine (desktop) snmp mib stuff the gkrellm* ports in sysutils are quick and easy to install.

If you are looking for intrusion detection then security/snort has been around for many years.

It all depends on what you want to see. If you don't have a clear picture of what it is you want to look at and why try a few different tools until you feel comfortable.

/grandpa
 
patpro said:
Grafana: not a fan at all, and needs a process to fetch data for you, needs work to create the dashboard, etc.
Click to expand...
There is no escaping this. For example I wanted lightest possible monitoring and I chose Munin.
I like the look. rrd graphs are fine for me but here is the rub.
To collect data the program needs plugins which require python.
I refuse to install anything like that on my firewall so I can't monitor my firewall.
So what is the sense? To monitor the rest of my network seems dumb when you can't monitor the master node.
I use sysutils/pftop for manual monitoring at times.

security/suricata has been on my list of tools to try.
But again. Python needed for a security tool? No thx.
Runtime dependencies: #
  1. py312-pyyaml>=0 : devel/py-pyyaml@py312
  2. python3.12 : lang/python312
Click to expand...
 
I mean it's a risk with putting net-snmp on a firewall server but imho that risk is easier to mitigate than having python and other stuff on it?

/grandpa
 
SNMP is blocked at the firewall for me so it would be fine for providing stats..I would trust it.
I really have no working SNMP knowledge beyond the term OID's.
I cut off most all UDP services to the world after seeing an old APC Network device leaking badly.
Vertiv device too.
It really pays to look at pftop when bored.
 
if you run FreeBSD as firewall and you have blocked snmp outgoing to world you could install net-snmp on the firewall, configure it to use snmpv3 with encryption and allow snmp traffic to the (LAN) server that runs Munin.

You will need to look into what MIBs you would need (MIBs have the OIDs) and put those on the FreeBSD firewall. Other than finding the correct MIBs I recall setup being fairly easy.

Then Munin would pick up the time period values with snmp client.

I think Dan Langille has something written on snmp that is fairly recent.

/grandpa
 
grandpa said:
Another way is aggregated data like the ELK stack. This means shipping logfiles to a server for analysis and reports.
Click to expand...
I won’t go the ELK road, too much hassle and I don’t trust Elastic. I’m a Splunk expert and I would go that way if I wanted to build something from scratch.

grandpa said:
Darkstat is a quick overview of datavolumes but has nothing on protocols or anything deeper.
Click to expand...
I’m currently giving Darkstat a run.
2 problems for me: it handles only one interface, it stays a little too much on the surface, I wish it could do just a tiny bit more (ntopng does way too much for my needs).

I’ll probably try to tame ntopng for another round: reduce it’s IO consumption and RAM/CPU usage. I’ve already cut IOs in half by hand-picking network interfaces (but still too much). May be I can disable few options…
 
It sounds like what you really want to do is sniff every packet off a FreeBSD network interface in real time and store those packets in a PCAP file? Later look at all those captured PCAP packets using wireshark or similar? So look for a CLI utility that uses the Berkeley Packet Filter (/dev/bpf) interface and that will do what you looking for. You will need to place the target FreeBSD ethernet network interface into "promiscuous mode" in order to capture every network packet -- (sounds 'complicated' - but it's not)

You might just be able to use the FreeBSD base builtin tcpdump(8) command for what you are trying to do.
 
CShell said:
It sounds like what you really want to do is sniff every packet off a FreeBSD network interface in real time and store those packets in a PCAP file?
Click to expand...
Nope, not at all, sorry for the misunderstanding.
I’m looking for a ready-to-run dashboard (huge pref for web-based dashboard), that will give more info than darkstat but cost less resources than ntopng.

(I’ll reassure you, I handle tcpdump / wireshark / pcap files just fine. I even used tcpdump+tshark in a full automatic setup to analyze and compare Borg, Kopia and Restic network behavior for a full month)
 
[do not visit]_www_freebsdsoftware_org_[do not visit ]/blog/best-monitoring-tools-freebsd/ compares a bunch of solutions.
 
Last edited by a moderator:
Ho Netdata is pretty cool! But I have to agree on this con: «The sheer number of metrics collected by default can be overwhelming if you only care about a handful of indicators» :D
I’ll keep it around, but stopped, until I need it.
 
Netdata is OK but I think I did not like how it worked..

Phishfry

Solved Post in thread 'Complete server monitoring tool'

I found a major drawback with Netdata. I knew it used distributed monitoring but what I don't care for is the use of cookies.
It does not remember your netdata monitored computers. You must visit each one to repopulate the list.
This is because I clear cookies on every browser exit.

Found this is the excellent documentation:
How my browser is identified?

Your browser gets a random GUID the first time it contacts the registry. This acts as a PERSONID. This is you. Every time the browser talks to the registry it gives this id back to the registry.

  • Where is...
Click to expand...
 
I revisited my Munin hangup and it looks like Munin collectors require perl and python.
I have no problem per-say with scripting languages but they do not need to be on a firewall.
My firewall has 20 total packages installed.
Can your firewall pass an audit?
/home/firewall # pkg leaf
devcpu-data-20230617
dnsmasq-2.93,1
iftop-1.0.p4_1
nmap-7.99_1
pftop-0.13
pkg-2.7.5
smartmontools-7.5_2
tripwire-2.4.3.8_2
ytree-2.11
Click to expand...

/home/firewall # pkg audit
0 problem(s) in 0 package(s) found.
Click to expand...
 
You must log in or register to reply here.
Back
Top