In response to a question asked recently, here is a list of the top 5 free tools that I use when starting out doing consulting in IT departments. These are free tools that are designed for monitoring networks from the inside, as opposed to external monitoring like that provided by microNOC.com.
In no particular order, here are the tools that reach for when starting on an unfamiliar network.
1) MRTG.
This tool is probably the basis for the majority of monitoring tools out there. Used to collect data points and generate graphs, MRTG is one of the best tools for collecting historic data (especially when used with RRDTool on the backend) and generating management and report friendly graphs and web pages.
Like all the tools that I list here, there is a bit of a learning curve with MRTG, but it’s not a steep one and it is a good choice for cutting your teeth on in the monitoring world.
2) Nedi
Nedi is a great tool if you are running a Cisco centric network. Once again a web based tool, Nedi keeps track of what equipment is plugged into which switch on a cisco network. That is a very basic explanation that doesn’t cover half the features available, but it is the first one that makes people reach out to Nedi. While my first use is usually to find machines that are causing issues, that rapidly turns into an inventory collection of the equipment on the network. Nedi pulls as much information as it can from every network device that it finds, gathering things like serial numbers, firmware versions and configurations.
If part of your job will entail managing end user devices, or if it’s just running a network that is having issues, Nedi is a great tool to deploy early to help track down issues.
3) Netflow Tools
If you are monitoring a network of any size, the odds are in your favor that your network routers support Netflow exports, which netflow tools capture and generate truly useful information. While MRTG can easily tell you that a network connection is overloaded, NetFlow will tell you why. A simple explanation of netflow is that it sends a constant stream of information from the router to a collection program. The stream of information includes the source IP address, the destination IP address, the ports or protocols in use and the size of the information in each data flow. No actual contents are captured, just information about the data. That flow of information can be used to create graphs that show what type of traffic is using up all your bandwidth, and also let you know what computer or device is generating or receiving all the traffic. Netflow tools are a necessity for learning about your network and what is going on with it on a day to day, or even hour to hour basis.
4) Nagios
Nagios is the big dog in terms of opensource monitoring frameworks. Used by tons of companies, and as the backend for several commercial offerings, Nagios provides you with a great tool for monitoring various things on your network, include server response, application response, database response and any number of other things. It also does alerting via email and it’s web display, has the ability to handle scheduled alerting (meaning that one person can be contacted during the week, another on the weekend), escalations for unanswered alerts and a decent web interface that includes mapping. It also allows for customization, with the ability to create your own monitoring scripts, or use some of the thousands of monitoring and alerting scripts that people have posted online.
On the downside, it’s not easy to setup. It’s text file based, doesn’t allow for changes without restarts and it can be finicky. However there are several liveCD or easy installation packages out there that include Nagios which make installation and setup a bit easier.
5) NTOP
NTOP is very similar to Netflow in that it watches for data streams and collects traffic information, displaying that info via a web interface. The significant difference is that, in its most basic form and configuration NTOP only watches one interface for that information. While that might not seem very useful at first glance, hooking a system running NTOP up to a network port that is mirroring the traffic of other ports is a quick and simple way to start gathering information about the traffic on your network.
In more advanced configurations, NTOP can be used to collect and display Netflow data, gather data from remote instances of NTOP and several other neat tricks.
All of these tools, plus a few more, are in my collection of tools. I use my toolkit all the time, especially when walking into a new network that I need to work on. I can get a great set of monitoring tools up and running in short order, and start collecting the data that I need to find problems and start working on solutions. And that is the key to success in running a network.
Next up in the tools category are a couple of packages that include several of the tools that I mention in a convenient bite size, easy installation package.
Stay tuned.