ntop ASA Support

Posted · Add Comment

ntop supports NetFlow since many years including the latest v9/IPFIX versions. In 2005 Cisco ha releases a new line of  x86 based security devices named ASA that unfortunately have not been supported by ntop/nProbe for a long time.

As of today (June 15th 2010, SVN revision 4299) ntop/nProbe finally supports ASA. Please note that as ASA units do not export templates too often, ntop might need some time to start decoding flows (this until the template is received). Furthermore as the nature of ASA flows (e.g. notify when a new connection inside the unit has been created/deleted) is not the same of NetFlow, some information is missing and need to be emulated by ntop/nProbe (e.g. the number of flow packets, so ntop computes them assuming that their size is 512 bytes).

Many thanks to David Bowman for his help during ASA support implementation.

References