Seems like everyday we have someone uninstall Scrutinizer because they didn’t realize their routers and switches don’t support NetFlow or sFlow.  About 3 years ago we released a software package called nProbeLive that was similar to nProbe.

nProbe can be installed on a computer which sits on a mirrored or spanned port of a switch.  Basically, it converts the packets seen into NetFlow v5, v9 or IP FIX.

Big Problem
A mirrored port may send in and out traffic ‘OUT’ the spanned port so the nProbe sees it all as ‘IN’ traffic.  What’s the problem? It will generally over state utilization on the interface and it is difficult to determine what was sent Vs. received.  Over coming this issue is done by making provisions in the configuration.

Wireshark or nProbe ?
NetFlow Analysis does not give nearly the insight as Packet Analysis however, it causes much less traffic.  If you need archiving of high level information (i.e who is talking with who and with what), use nProbe.  If you are trying to get juicy details like URLs, etc. use Wireshark.

Scrutinizer Vs. Wireshark
We look at Scrutinizer as being to NetFlow what Wireshark is to packet analysis.  The archiving capabilities of NetFlow and sFlow are much more efficient.  The details however, are left to packet analysis.

Mike Patterson author pic


Michael is one of the Co-founders and the former product manager for Scrutinizer. He enjoys many outdoor winter sports and often takes videos when he is snowmobiling, ice fishing or sledding with his kids. Cold weather and lots of snow make the best winters as far as he is concerned. Prior to starting Somix and Plixer, Mike worked in technical support at Cabletron Systems, acquired his Novell CNE and then moved to the training department for a few years. While in training he finished his Masters in Computer Information Systems from Southern New Hampshire University and then left technical training to pursue a new skill set in Professional Services. In 1998 he left the 'Tron' to start Somix which later became Plixer.


Leave a Reply