Netflow for Windows Servers

Greetings.

In my shop we're just starting to work with Netflow. We don't have config rights to the routers and switches, so starting with a few Windows servers. We have servers polling with the SolarWinds agent.

Question: besides setting up the server/interface as a Netflow source, is there any specific configuration that needs to happen on the servers to send Netflow packets? In Netflow sources the Receiving Engine says 'Not Applicable' so I assume some configuration needed on the server. Btw I am aware about port 2055 - I think we have that covered.

I welcome any inputs from the community. Thanks.

Find more posts tagged with

netflow_nta

netflow

netflow_traffic

Accepted answers

All comments

Deltona

Windows can't generate flow data. You will need to configure flow on the switches that the Windows hosts are connected to, and direct the flow to your SolarWinds server on UDP 2055.
https://documentation.solarwinds.com/en/success_center/nta/content/nta-nta-flow-requirements-sw145.htm

verwin_u

@robert777

@Deltona is correct. Netflow are for network device like, router and switches.

https://www.solarwinds.com/netflow-traffic-analyzer

Netflow analyzes the packet level data of your device that is why more of the configuration are with your network devices. Feel free to ask your network vendor to configure and enable netflow and send it to to your sw netflow collector.

https://documentation.solarwinds.com/en/success_center/nta/content/nta-device-configuration-examples-sw1967.htm

If you still encounter issue with netflow. Feel free to contact our sw geeks for support.

mesverrum

Assuming you use vcenter and have the distributed vswitches available with your license type then your vcenter can generate flow for the traffic coming and going to each VM, regardless of the OS.

I've also used the Host Sflow tool in the past to generate flows from windows machines, its a bit annoying because all the config is done with reg keys and there is no UI, but i've used it to populate demos several times.
https://sflow.net/host-sflow-win-config.php

akhasheni

standard vSwitches - cannot send flow? (vCenter 7.03 here, 40+ ESXis across 20+ remote branches, all on standard vSwitches)

Thanks!

mesverrum

It was only for dvswitches back when I did my vmware certs, and it looks like that's still the case in their docs.

techdocs.broadcom.com/.../configure-netflow-settings-with-the-vsphere-web-client.html