Netflow Configuration
- Yeok Hong Ng (Deactivated)
You open the Netflow collection agent configuration dialog from a workflow configuration. To open the Netflow collection agent configuration, click Build → New Configuration. Select Workflow from the Configurations dialog. When prompted to Select workflow type, select Realtime. Click Add agent and select Netflow from the Collection tab of the Agent Selection dialog.
Connection Tab
NetFlow agent configuration dialog - Connection tab
Field | Description |
|---|---|
Received Settings | |
Port | The port number where the NetFlow agent will listen for packets from the routers. Note!Since the routers will be configured to communicate with a specific host on this port, it is important that the workflow containing the NetFlow agent is configured to execute on that specific host and not on a random host. Two NetFlow agents may not be configured to listen on the same port on the same host. |
IP Address | Enter the IP address of the target host. |
Only from Predefined Hosts | If enabled, the agent will only accept packets from hosts specified in the Interface Mapping tab. Data from other hosts will be discarded. If disabled, all arriving data will be accepted. This may be suitable if a combination of routers is used. When a majority of the routers only send from one interface (IP-address) each, and some is set according to the Interface Mapping tab. Hence, when disabling this option, the one-interface-routers do not have to be added to the interface mapping list. |
Warn on Sequence Gap |  Determines if a warning will be raised in the System Log when the sequence number gap between two sequential PDUs from the same router is equal to or larger than specified in the Minimum Gap. |
Minimum Gap | The minimum sequence number gap between two flow records that will cause warning in the System Log. |
Receive Buffer Size | Enter the buffer size for messages to read in this field. The value should not exceed the value set for the kernel parameter Example on how to set the kernel parameters$ sudo sysctl -w net.core.rmem_max=18388600
$ sudo sysctl -w net.core.netdev_max_backlog=100000 |
UDR Type Tab
NetFlow agent configuration dialog - UDR Type tab
Field | Description |
|---|---|
Add | Select this button to open the Add UDR Internal Format Browser. Here you can add the desired UDR types. |
Remove | Removes the selected entry. |
Interface Mapping Tab
NetFlow agent configuration dialog Interface Mapping tab
Maps several interface IP addresses to one main IP address. Each router using more than one interface IP address when sending data to the agent must be registered here. One of the IP addresses, supported by the router, must be registered as Main IP Address . The others are configured in the IP Address list.
If a packet arrives from an IP address configured in the IP Address list, it will be mapped to the corresponding Main IP Address. This way it will appear as if all packets originating from the same IP address.
Field | Description |
|---|---|
Main IP Address |  Each router that supports multiple interfaces must add one address to this list. When an existing row is selected, the content in the IP Address table will reflect the slave IP addresses for the selected Main IP Addresses. |
IP Addresses | Additional IP addresses are mapped to their corresponding main IP address by the agent. |
You can use the buttons below the two main sections to Add, Edit, or Remove the available entries.Â