NetFlow FlowAnalyzer V2.0 Release Notes

Contents

This release note contains platform and system requirements and instructions for installing and setting up the NetFlow FlowAnalyzer application.

This release note contains the following sections:

• Platforms Supported

• Hardware Requirements

• Software Requirements

• Installing and Starting the FlowAnalyzer for the First Time

• New Features

• Stopping and Restarting the FlowAnalyzer

• Known Restrictions

• Cisco Connection Online

Platforms Supported

The NetFlow FlowAnalyzer application is supported on Solaris 2.5.1 and 2.6. and HP-UX 10.2.

The NetFlow FlowAnalyzer Display module will also run on Windows NT 4.0.

Hardware Requirements

The NetFlow FlowAnalyzer application requires the following hardware:

• 256 MB of physical memory (RAM) and 400 MB of free logical memory (for the DisplayServer host machine)

• 70 MB free disk space for tar and uncompressed installation files (these files can be deleted after installation); 50 MB of free disk space for the installed executables; 25 MB is required for the FlowAnalyzerDisplay module executables running on a PC

• If you are running the FlowAnalyzer Display module on a PC, a Pentium class machine with a 166 Mhz or faster CPU with 64 MB or more of physical memory (RAM) is required

Software Requirements

The NetFlow FlowAnalyzer application requires the following software:

• HP-UX 10.20 systems must be running at least the April, 1998 version of Hewlett Packard's General Release Recommended patches, which includes the Extension Software patch bundle XSW700GR1020/CR1020 B-10.20.37.

• The Bourne shell "sh" (/bin/shell) must be available for execution

• The following standard utility programs must be in the /usr/bin or /bin directory, or be set in your PATH environment variable:

  • awk

  • basename

  • cat

  • cd

  • chmod

  • echo

  • expr

  • kill

  • ls

  • mkdir

  • nohup

  • ps

  • pwd

  • rm

  • sed

  • touch

  • unalias

  • wc

  • whoami

Installing and Starting the FlowAnalyzer for the First Time

To install and start the FlowAnalyzer for the first time, perform the following steps:

Step 1 Log into the workstation as root:

$ su root
password: <enter the password>

Step 2 Untar the tar file, as follows:

(a) For Solaris:

# tar -xvf NFA2_0.SOL.tar



(b) For HPUX:

# tar -xvf NFA2_0.HP_10.tar

Step 3 Run the installation script and answer all questions.

(a) For Solaris:

---

Note The installation script will ask you whether or not you want to start the Display module user interface for you. If you do, make sure you have enabled remote X connections to your workstation by a command such as "xhost +" before you start the installation script.

---

# ./NFA2_0.setup.sh ./NFA2_0.SOL.Z



(b) For HPUX:

# ./NFA2_0.setup.sh ./NFA2_0.HP_10.Z

You have completed the NetFlow FlowAnalyzer installation process.

New Features

New Features of FlowAnalyzer Version 2.0 include the following:

• User views--Users may customize their views by adding/removing FlowCollector data set directories as well as creating logical router groups.

• Autonomous System (AS) Drill Down--View DetailASMatrix aggregation scheme data grouped by AS to AS summaries. Each AS to AS summary can be exploded to show the protocols used and the IP addresses used in creating the summary.

• Search Functions--Search for IP to/from IP traffic as well as IP to/from subnet traffic.

• Load Sharing--One FlowAnalyzer graphical user interface (GUI) can simultaneously access the NetFlow data stored on different workstations.

• Multiple router selection--Users can display NetFlow data for like aggregation schemes collected across multiple NetFlow-enabled devices in one Display module NetFlow data array.

• Periodic downloading of AS numbers and names from ARIN, RIPE, APNIC, RADB, as well as the ports file from IANA.

• DNS is used to resolve IP addresses in the data tables.

Stopping and Restarting the FlowAnalyzer

This section tells you how to stop and restart the FlowAnalyzer software modules.

Step 1 Log in as root (superuser):

$ su root
password: <enter the password>

Step 2 To stop the FlowAnalyzer, run the stop.All shell script:

# /opt/CSCOnfa/stop.All

Step 3 To restart the FlowAnalyzer, run the start.All shell script:

# /opt/CSCOnfa/start.All

Known Restrictions

The following is a list of know restrictions for FlowAnalyzer Version 2.0:

Restriction 1

If you want to run the FlowAnalyzer Display module from an NT platform, you must first set protections on the NFADisplay directory and all of its subdirectories by issuing the following command as root:

# chmod -R 777 /opt/CSCOnfa/NDADisplay

Then you must copy the /opt/CSCOnfa/NFADisplay and all of its subdirectories and files to the target directory on your PC, change directory (cd) into the NFADisplay/bin directory, and then enter the startPC_Display.bat file.

Restriction 2

If you cannot invoke help under NT, do the following:

1 . Open Explorer.

2 . Find the script startPC_Display in the NFADisplay\bin directory.

3 . Click the right mouse button over the script and select Edit.

An editor window should open up containing the script.




4 . Move your mouse over the icon that corresponds to your Internet browser.

5 . Click the right mouse button and select Properties.

6 . Go to the field entitled Target and do a Right Button->Copy.

7 . Go to the editor window. Put the cursor after the -browser command line option.

8 . Delete the argument that follows the -browser command line option.

9 . Select Edit->Paste.

This should put the correct browser path\program name in your script. Make sure that it is quoted.




10 . Select File->Save.

You are now prepared to run the start script.

Restriction 3

The FlowAnalyzer Display will print an "Out of Memory" message on the terminal window from which it was invoked if it runs out of memory.

A workaround for this condition is to edit the startPC_Display.bat file and place the -ss, -oss, and -mx options on the jre call.

For example:

/opt/CSCOnfa/NFADisplay/RunTimeJava/bin/jre -ss2m -oss2m -mx32m -cp ...

A description of these options can be found at: http://java.sun.com/products/jdk/1.1/jre/README.

Restriction 4

Although the FlowAnalyzer Display can run in a mode where it is executing on a UNIX machine and the output is sent to an X server running on a PC using an X windows emulator, this is not a supported configuration.

Restriction 5

The FlowAnalyzer Display will not run under OpenWindows.

Restriction 6

The AS Drill Down window and the Search window both require the use of the DetailASMatrix aggregation scheme.

Restriction 7

The Display module may crash or exit when you select an aggregation scheme for more than one device at a time for display. A workaround for this problem is to retrieve NetFlow data for the desired aggregation scheme for each device one at a time.

Cisco Connection Online

Cisco Connection Online (CCO) is Cisco Systems' primary, real-time support channel. Maintenance customers and partners can self-register on CCO to obtain additional information and services.

Available 24 hours a day, 7 days a week, CCO provides a wealth of standard and value-added services to Cisco's customers and business partners. CCO services include product information, product documentation, software updates, release notes, technical tips, the Bug Navigator, configuration notes, brochures, descriptions of service offerings, and download access to public and authorized files.

CCO serves a wide variety of users through two interfaces that are updated and enhanced simultaneously: a character-based version and a multimedia version that resides on the World Wide Web (WWW). The character-based CCO supports Zmodem, Kermit, Xmodem, FTP, and Internet e-mail, and it is excellent for quick access to information over lower bandwidths. The WWW version of CCO provides richly formatted documents with photographs, figures, graphics, and video, as well as hyperlinks to related information.

You can access CCO in the following ways:

• WWW:  http://www.cisco.com

• WWW:  http://www-europe.cisco.com

• WWW:  http://www-china.cisco.com

• Telnet:  cco.cisco.com

• Modem:  From North America, 408 526-8070; from Europe, 33 1 64 46 40 82. Use the following terminal settings: VT100 emulation; databits: 8; parity: none; stop bits: 1; and connection rates up to 28.8 kbps.

For a copy of CCO's Frequently Asked Questions (FAQ), contact cco-help@cisco.com. For additional information, contact cco-team@cisco.com.

---

Note If you are a network administrator and need personal technical assistance with a Cisco product that is under warranty or covered by a maintenance contract, contact Cisco's Technical Assistance Center (TAC) at 800 553-2447, 408 526-7209, or tac@cisco.com. To obtain general information about Cisco Systems, Cisco products, or upgrades, contact 800 553-6387, 408 526-7208, or cs-rep@cisco.com.

---