# Bro vs Netflow **URL:** \ **Category:** Zeek\ **Created:** [June 20, 2015, 10:33am UTC](https://community.zeek.org/t/bro-vs-netflow/3668 "2015-06-20T10:33:52Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [June 20, 2015, 10:33am UTC](https://community.zeek.org/t/bro-vs-netflow/3668/1 "2015-06-20T10:33:52Z")
So in my internet travels I ran across this: [https://www.rsreese.com/parsing-netflow-using-kibana-via-logstash-to-elasticsearch/](https://www.rsreese.com/parsing-netflow-using-kibana-via-logstash-to-elasticsearch/) A tad outdated but I thought why not…I have syslogs and Bro’s conn.log going into the ELK stack, so let’s add netflow to the mix. After dinking around with it and getting the data in, I realized that Bro’s conn.log pretty much does everything netflow can…unless I’m missing something? For example, if I want to see what a single IP address is doing I use this as a filter in Kibana: type:connlog AND conn\_state:S\* AND src\_ip:192.168.1.100 AND proto:TCP type:connlog AND conn\_state:S\* AND src\_ip:192.168.1.100 AND proto:UDP What say you all…any reason not to rip out softflowd and just drive on with Bro’s conn.log? Thank you. James ---
**Author:** ![Andrew\_Ratcliffe](https://avatars.discourse-cdn.com/v4/letter/a/898d66/32.png) [@Andrew\_Ratcliffe](https://community.zeek.org/u/Andrew_Ratcliffe)\ **Post date:** [June 20, 2015, 11:05am UTC](https://community.zeek.org/t/bro-vs-netflow/3668/2 "2015-06-20T11:05:50Z")
James, I think you’re right, but sometimes you can get Netflow from locations where you might not easily be able to put a Bro sensor. Kind regards, Andy [Andrew.Ratcliffe@NSWCSystems.co.uk](mailto:Andrew.Ratcliffe@NSWCSystems.co.uk) CISSP, GCIA, GCIH, GPEN, GWAPT, CSTA, CSTP, CWSA, GCFE [Blog.InfoSecMatters.net](http://blog.infosecmatters.net/) ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [June 22, 2015, 8:00pm UTC](https://community.zeek.org/t/bro-vs-netflow/3668/3 "2015-06-22T20:00:42Z")
Andrew got the exact reason that you’d still collect netflow. The Bro conn log is significantly different than netflow though. It’s bidirectional (IPFIX can be too, but we’ll ignore that for now). The log doesn’t write out until the connection is complete, whereas netflow breaks and writes out frequently which can be great, but can also be super annoying if you’re trying to pay attention to the full life cycle of a connection forensically. There are several extra fields in the Bro logs that netflow doesn’t have too (history and service being two that immediately come to mind). If you’re generating netflow though, there is almost never any benefit these days unless you have a netflow analysis solution in place that you’d like to feed and you can’t collect from routers anymore, usually because your routers can only do sampled netflow.   .Seth ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [June 22, 2015, 8:37pm UTC](https://community.zeek.org/t/bro-vs-netflow/3668/4 "2015-06-22T20:37:29Z")
Thanks Seth, I took out softflowd and reverted to my previous version of logstash.conf. I have to say, it was pretty cool to have my Kibana graphs up of Bro's conn.log and softflowd side by side to compare....was pretty awesome. James ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [June 22, 2015, 8:44pm UTC](https://community.zeek.org/t/bro-vs-netflow/3668/5 "2015-06-22T20:44:15Z")
Nice, did you notice any major discrepancies?   .Seth ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [June 22, 2015, 8:51pm UTC](https://community.zeek.org/t/bro-vs-netflow/3668/6 "2015-06-22T20:51:22Z")
I did not besides the minor timing thing you described. For example there's an Android device that fires off to [ssl.analytics.google.com](http://ssl.analytics.google.com) at exact intervals. The netflow graph showed these at pretty close to the same times (squid logs logged the exact time to syslog), whereas Bro had them a little varied, but that was ONLY when you dug in like to a every 5 minute graph. If you zoomed out to say showing the last 12 hours you couldn't tell a difference at all. I didn't notice a difference in the packet count or size either....a good thing 🙂 James ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/bro-vs-netflow/3668/7 "2022-05-06T15:42:47Z")
Closed on May 6, 2022, 3:42pm UTC