I too am very happy with Plixer/Scrutinizer. Been using them for about 3 years. As Rick said, support is awesome. I know most of the support guys there by name and had to use them this morning to migrate to a new server.
Jeff Wojciechowski Network Engineer II - Midland Paper Company -----Original Message----- From: cisco-nsp [mailto:[email protected]] On Behalf Of Rick Coloccia, Jr. Sent: Wednesday, May 21, 2014 2:10 PM To: Eric Van Tol; [email protected] Subject: Re: [c-nsp] Netflow analysis tools? +1 Plixer/Scrutinizer. Very affordable, powerful, easy to use, very responsive to service requests. Been happy for years with them. On 5/19/2014 10:30 AM, Eric Van Tol wrote: >> -----Original Message----- >> From: cisco-nsp [mailto:[email protected]] On Behalf Of >> Scott Granados >> Sent: Friday, May 16, 2014 10:16 AM >> To: [email protected] >> Subject: [c-nsp] Netflow analysis tools? >> >> Good morning, >> I'm starting to work with Net Flow data and am looking for both good >> background documentation to get more familiar and suggestions for an >> analyzer. > Scott, > > Disclaimer: Long email, no financial stake in any company discussed. > > We recently went through a Netflow comparison between Plixer Scrutinizer and > Solarwinds NTA after evaluating some open source tools which we were not > quite satisfied with. We ended up going with Scrutinizer for a few reasons: > > Better pricing model (for us) - we only needed a small number of exporters > (under 25). The SW pricing model is such that the NTA license must follow > the NPM license, so if you have an SLX (unlimited) license (like we have), > you need an SLX NTA license ($15K list). The alternative is that you can > purchase another small 25-node license of Orion *and* NTA. Scrutinizer > 25-node license was less expensive (with appropriate end-of-quarter > discounts) and supports unlimited number of interfaces per exporter. Yearly > software maintenance is less expensive, too. > > More version support - Plixer supports v5, v8, v9, and IPFIX formats and > IP/IPv6/MPLS Netflow data. Solarwinds has no plans on supporting IPv6 or > MPLS - IPv6 has been a feature request for more at least 3 years on their > support forum and unless one of their Fortune 500 enterprise customers > absolutely demands MPLS support, forget about that getting added. > > Reporting - Scrutinizer supports dozens of reports right out of the box. NTA > only had a dozen or so. The process by which you can build reports in NTA > was more tedious than it is in Scrutinizer. > > Analyzation - Scrutinizer has the ability to do "flow analytics" that can > examine the incoming data and identify things like suspected DDoS attacks, > botnet activity, brute force attacks, etc. and alert you based on criteria > you set. > > OS - NTA requires Windows, obviously, whereas Scrutinizer's virtual appliance > uses ESXi host and is a CentOS guest install. They do have a less-expensive > standalone Windows installer, but it does not support more than around 10K > flows per second (fps), but this may suit you. > > Sales - The Plixer sales person was very respectful of my time to make a > decision. He gave me the end-of-quarter parameters and checked in with me > once every week or two weeks or whenever I had a question. The Solarwinds > sales person kept calling and emailing, and just plain being a damned pest > about it. He pissed me off, and to be honest, this was one of the biggest > reasons I went with Plixer. Note to sales people - I don't give a s**t how > tenacious you are - when I tell you not to bug me and flat out tell you that > you are being a pest, you can be sure I won't purchase your product. > > Both supply web-based GUIs, configurable dashboards, configurable alerting, > and mapping capabilities. Solarwinds has a more "polished" interface and is > definitely a lot more "pretty" to look at, but when it came right down to it, > we felt that Scrutinizer was the better choice, given the above points. That > said, SW NTA is a great product and might be a good choice if you have > executives or non-technical people that like great-looking reports and/or if > you are lonely and feel like talking to a sales droid whose only motivation > is to sell you NTA with the ingrained tenacity of a T-1000 looking for John > Connor. > > -evt > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ -- Rick Coloccia, Jr. Network Manager State University of NY College at Geneseo 1 College Circle, 119 South Hall Geneseo, NY 14454 V: 585-245-5577 F: 585-245-5579 _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ ________________________________ This electronic mail (including any attachments) may contain information that is privileged, confidential, or otherwise protected from disclosure to anyone other than its intended recipient(s). Any dissemination or use of this electronic mail or its contents (including any attachments) by persons other than the intended recipient(s) is strictly prohibited. If you have received this message in error, please delete the original message in its entirety (including any attachments) and notify us immediately by reply email so that we may correct our internal records. Midland Paper Company accepts no responsibility for any loss or damage from use of this electronic mail, including any damage resulting from a computer virus. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
