Setup Cisco 3750 for netflow using Nprobe

ldeffinbaugh

Trying to setup a Cisco 3750 for netflow using Nprobe to send the data to NTA

Find more posts tagged with

netflow

cisco 3750

nprobe

nta

Accepted answers

D_Dal

You need to configure port mirroring on your switch first. You can check here for the steps involved.

With nProbe and NTA you must be managing the machine and interfaces on the machine that you have nProbe on, with NPM. manage all the active nProbe server interfaces in NPM, and set in to 1 and out to 2.

See attached for useful Info, also particularly good thread below:

http://thwack.com/blogs/orion-product-team-blog/archive/2009/11/10/orion-nta-and-nprobe-analyzing-bandwidth-hogs-without-flow-capable-network-equipment.aspx

Configure nProbe to export flows to Orion NTA

Open command prompt on nProbe server and navigate to C:\Program Files\nProbe-Win32>
Run nProbe from CLI using the options listed below:

nprobe

/c - output to console. This is the easiest method, especially for a demo situation, because you can review the debug messages.

-n <Orion NTA server address>:<port> - IP address and port that should receive the flow records. Use 2055 for port.

-b 1 - modest level of reporting

-i <interface> - generally 1 on Windows; en0/eth0 on Linux; en0 for Ethernet on OSX, en1 for wireless

-u <in-index> - sets the ingress interface for all flows (use 1).

-Q <out-index> - sets the egress interface for all flows (use 2).

E.g. nprobe /c -i 1 -n 10.199.15.50:2055 -b 1 -u 1 -Q 65539

NOTE: It’s important the ingress (-u) and egress (-Q) interface indexes be set to the server interfaces being managed in Orion. NTA will drop flows from interfaces that are not managed in Orion. You can see the interface index for the server interfaces in Orion by drilling down to their respective interface details view. So, if your nProbe server had two interfaces being monitored in Orion NTA, you would just set the option –u to the index of one of them and the –Q switch to the index of the other. See nProbe documentation for other command line options.

All comments

donthomas

This post should help you with nprobe config:

Orion NTA and nProbe: Analyzing bandwidth hogs without flow-capable network equipment

D_Dal

You need to configure port mirroring on your switch first. You can check here for the steps involved.

See attached for useful Info, also particularly good thread below:

http://thwack.com/blogs/orion-product-team-blog/archive/2009/11/10/orion-nta-and-nprobe-analyzing-bandwidth-hogs-without-flow-capable-network-equipment.aspx

Configure nProbe to export flows to Orion NTA

Open command prompt on nProbe server and navigate to C:\Program Files\nProbe-Win32>
Run nProbe from CLI using the options listed below:

nprobe

/c - output to console. This is the easiest method, especially for a demo situation, because you can review the debug messages.

-n <Orion NTA server address>:<port> - IP address and port that should receive the flow records. Use 2055 for port.

-b 1 - modest level of reporting

-i <interface> - generally 1 on Windows; en0/eth0 on Linux; en0 for Ethernet on OSX, en1 for wireless

-u <in-index> - sets the ingress interface for all flows (use 1).

-Q <out-index> - sets the egress interface for all flows (use 2).

E.g. nprobe /c -i 1 -n 10.199.15.50:2055 -b 1 -u 1 -Q 65539

NOTE: It’s important the ingress (-u) and egress (-Q) interface indexes be set to the server interfaces being managed in Orion. NTA will drop flows from interfaces that are not managed in Orion. You can see the interface index for the server interfaces in Orion by drilling down to their respective interface details view. So, if your nProbe server had two interfaces being monitored in Orion NTA, you would just set the option –u to the index of one of them and the –Q switch to the index of the other. See nProbe documentation for other command line options.