Netmon VS Solarwinds

Network Monitoring Comparison Solarwinds and Netmon

Network Monitoring is essential for every network administrator. It determines how effective your IT team is at solving problems or even completely eliminating them. Even small organizations need visibility of what is happening within their network environment. This includes the ability to know what is happening with their servers, network infrastructure and the traffic that flows across the network and all connected network devices. There are close to one hundred products on the market today (a combination of commercial and open source) that provide some level of network performance monitoring (NPM) capabilities. The majority of the products utilize standards that have been used for the past 20 years such as SNMP (Simple Network Management Protocol) and recently WMI (Windows Management Instrumentation) which is Microsoft’s implementation of the Web Based Enterprise Management.

Download in PDF

Head-To-Head Comparison

Although Solarwinds and Netmon provide varying levels of network performance monitoring, they also differ tremendously in terms of their architecture.


is sold as an appliance with a base operating system that is built on the Debian Linux Distribution. Netmon’s solution includes all applicable software and hardware for providing complete network monitoring for most mid-sized network environments as part of its offering. Netmon does not require any additional software or licenses for the operating system or database as they are all included with the package. Licensing – Netmon provides unlimited device monitoring based on what the appliance hardware can physically support (which can vary depending on which components of monitoring are user enabled).

Solarwinds NPM

is one of the many individual software applications that are provided under the Solarwinds brand. They also offer additional software components that can be purchased in order to provide their full suite of network performance monitoring (including network bandwidth analyzer, Netflow traffic analyzer, VOIP & network quality manager, log & event manager to name a few). Solarwinds is a Windows based application which must be installed onto a dedicated Windows server. As part of its installation it also installs Microsoft SQL Express 2008 R2 as its database component. For larger network environments, Solarwinds suggests upgrading the database to Microsoft SQL Server (running on a separate server in larger environments). The cost of licensing Microsoft Server, SQL are NOT included as part of the Solarwinds purchase. The application front end is accessed utilizing a web browser with support for the major web browsers available today. Licensing: Solarwinds is licensed by the largest number of the three following element types: Interfaces: Interfaces include switch ports, physical/virtual interfaces, VLANs Nodes: nodes include entire devices (routers, switches, servers, APs) Disk Volumes: volumes are equal to the logical disks you wish to monitor

Functionality Comparison

Solarwinds NPM (Version 11.5)

The Solarwinds network performance monitor application typically targets enterprise-level environments rather than small and mid-sized companies. The product is primarily designed to monitor the performance of network devices. If a company needs to monitor actual network traffic, application monitoring, or other forms of monitoring such as eventlog / syslog monitoring, they would need to use a different product and / or purchase additional modules within the Solarwinds suite. These include Netflow Traffic Analysis, WAN and VoIP QoS performance monitoring, Log & Event Manager as well as several other modules. Although Solarwinds provides network packet analysis with their Quality of Experience module, this feature requires a sensor to be installed on each individual servers or dedicated machine / network device to provide traffic analysis. When tested, the configuration for the QoE module requires the user to configure every type of network traffic (network protocol) that they wish to monitor / analyze on a per device basis. In a large network environment, configuring sensors for ALL different types of network traffic for hundreds (/ thousands) of devices would be a daunting and time consuming task. Support for Netflow Traffic analysis – Solarwinds has an additional module / application called the Netflow Traffic Analyzer (currently at version 4.1.2) available for an additional cost that can be integrated with the NPM product to provide a more enriched level of traffic analysis. This software supports Cisco® NetFlow, Juniper® J-Flow,sFlow®, Huawei NetStream™ & IP FIX flow data. The data collector captures and analyzes the flow data that is integrated into most routers and converts that data into easy-to-interpret charts and tables that quantify how the network is being used, by whom and for what purpose. Network Availability & Performance Monitoring – Solarwinds monitors network device and interface availability, performance indicators such as bandwidth utilization, packet loss, latency, errors, discards, CPU, and memory for SNMP and WMI-enabled devices. Syslog Monitoring – Solarwinds has an additional module / application (Kiwi Syslog Server) available for an additional $295.00 per install cost that receives syslog messages and SNMP traps from network devices (routers, switches, firewalls, etc.), and Linux®/Unix® hosts. You can filter and view these messages based on time, hostname, severity, etc., and set up custom alerts.

Solarwinds Home Dashboard
Solarwinds Event Viewer
Solarwinds Top 10 Lists
Solarwinds Environment Dashboard

Netmon (Version 6.2)

Netmon is sold as a complete appliance and software solution, and targets midsize to enterprise level environments. Netmon includes a suite of monitoring tools with a focus on providing a device centric vantage point of the network. Its main differentiator is that it can provide real time network traffic analysis without any additional modules / purchases (i.e. Netflow, JFlow or a separate Sensor that must be installed on a separate Server). Netmon’s traffic analysis engine is practically plug and play. The appliance comes with an additional network interface on the appliance (and is further expandable) that can simply be plugged into a port-mirrored interface on a core network switch (or switches). Once the IP Packet Analyzer service is enabled, traffic analysis is fully functional and it provides immediate feedback including (on the Home Dashboard) top network activity – who is talking to who, a protocol analysis graph and the visual network explorer which displays the top network conversations on the network. Netmon includes a data collector module which supports Cisco® NetFlow and sFlow and integrates that data the exact same way that it presents the sniffed traffic from its traffic analysis engine. This allows multiple protocol analysis graphs to be shown on the home dashboard representing both sniffed traffic from the integrated local network traffic analysis engine as well as Netflow traffic streams that can be configured on routers (cisco) at remote locations and then sent to Netmon for a complete multi location network view and breakdown. Network Availability & Performance Monitoring – Netmon monitors network device and interface availability, performance indicators such as bandwidth utilization, packet loss, latency, errors, discards, CPU, and memory for SNMP-enabled devices. Netmon provides the ability to import custom SNMP MIBs for monitoring specific and more granular performance metrics. Since Netmon does not currently support WMI (which is a Microsoft-centric technology), it provides a custom dashboard for all Windows devices utilizing a free SNMP agent for monitoring performance metrics on Windows Servers, and Workstations (i.e. CPU, RAM, Disk I/O metrics etc.). Syslog Monitoring – As part of a full featured monitoring system Netmon includes the ability to receive SYSLOG messages from network devices (routers, switches, firewalls, etc.), and Linux®/Unix® hosts. You can filter, view and create custom alerts for these SYSLOG messages based on time, host, severity and alert message.

Protocol Analysis Graph on Home Dashboard
Virtual Network Explorer
(Cisco Switch) Device Dashboard
SYSLOG / Event Log per Device View
Windows (Server) Device Dashboard

Functionality Summary

Cost Comparison

A cost comparison based on monitoring 1000 devices – Since the two products have a completely different sales and pricing models, assumptions had to be made in regards to hardware requirements and cost, additional software modules (based on the monitoring capabilities in the chart above) for Solarwinds.

Netmon Appliance – Vs 6.4

Total Investment Cost$ 9,995.00 USD
Includes unlimited device licensing
The actual number of devices that can be monitored may be limited depending on the amount of network traffic and Netflow traffic also being analyzed
Additional appliances can be purchased to separate the network traffic analysis load from the network device polling

Solarwinds Licensing and Costs

SolarWinds NPM SL2000 (up to 2000 elements) Software License$ 17,085.00 USD
SolarWinds NetFlow Traffic Analyzer Module for NPM SL100 (100 Device license)$ 1,875.00 USD
Solarwinds Kiwi Syslog Server (Single Install)$ 295.00 USD
 Server Hardware for Solarwinds NPM (1000 Device Capacity)$ 20,000.00 USD
• Recommended configuration as per Thwack Forum community
• Requires separate Servers for MS SQL Database and NPM / Netflow / Kiwi Syslog applications
• Requires Microsoft Windows Server licensing & Microsoft SQL licensing
Total Investment Cost (Hardware & Software licensing)$ 39,255.00 USD

Want to learn more about Netmon?

Feel free to look around our website and try our live working demo of Netmon in our offices. Let us know if you have any questions about this white paper or Netmon, or if you would like to schedule a webinar / phone demo with us!