Netflow Replicator on Orion Polling Engine

Question

@jreves

Is it possible to use the SolarWinds Flow tools bundle to replicate flows to another consumer from an Orion Polling Engine?

We have all our flows going to our primary Orion polling engine and would like to replicate those flows to another security tool. Would using the NetFlow Replicator accomplish this?

How would we be able to measure how much bandwidth we are currently using in flow data that we would be duplicating?

https://thwack.solarwinds.com/free-tools-trials/f/flow-tools-bundle/1238/solarwinds-flow-tools-bundle-quick-reference-guide

SolarWinds Flow Tools Bundle Quick Reference Guide - Flow Tools Bundle - Free Tools & Trials - THWACK

dclick · Answer

I haven't seen this from Orion, but - I built a small Linux host to replicate both syslog and Netflow.  For syslog, you can use rsyslog or syslog-ng and redirect your output to multiple destinations.

For netwflow - look for "samplicator". Its a very small, easy to use redirector for Netflow.

This makes it so much easier to add/change destinations of your logs or netflows w/o directly touching your devices.  We have been doing this for years now.

saw10 · Answer

I posted a "paper" about this type of issue, Have a look It my answer your question
Along the river of data, there are streams and flows. (Packet Streams and Data Flows)