cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 7

RSPAN - NETFLOW CONFIG

Is there anyway RSPAN traffic can be exported using netflow and collected by Solarwinds NTA for analysis and presentation?

Here is the situation:

I have Cisco 48port 2960S Switch 15.0(2) configured with VLANs for client access. The intention is to have the traffic from a few VLANs on that switch to be exported to Solarwinds NTA but was told that the Switch doesn't support Netflow.

As an alternative, I was told to configure Port mirroring and have the traffic mirrored to a destination port on a netflow capable switch. In this case, RSPAN was configured  on the 48port 2960S Switch 15.0(2) to send the vlan traffic to a destination port on cisco switch 2960x 15.2(2) (this switch supports Netflow).

To this end, I am unable to get the expected results. Kindly see configuration on both switches and NPM with NTA current results attached.

Your assistance is greatly appreciated.

Regards,

Kamoy

Labels (3)
0 Kudos
3 Replies

Nprobe is free but you need to invest time. You don't really integrate it, you use it to convert the SPAN traffic to flow. I was never a huge fan of RSPAN because you are potentially sending high volumes of unprocessed packets across a LAN link. Better to deal with the SPAN traffic as close as possible to where it is generated.

Our own tool requires an investment but gives a hybrid approach. Flow and some of the packet payload information.

0 Kudos

Hi kamoy

Two other options.  You could connect the SPAN port to an nProbe device which would convert the packet info to flows. More reading here

Orion NTA and nProbe: Analyzing bandwidth hogs without flow-capable network equipment

Another alternative is to use a commercial product we develop called LANGuardian which connects directly to a SPAN port and the flow\user\application we gather can be displayed within your SolarWinds views like this, the elements in the first row are all using data gathered via a SPAN port by LANGuardian

http://demo2.netfort.com/Orion/SummaryView.aspx?ViewKey=Network%20Top%2010&AccountID=guest

Hope this helps

Darragh

0 Kudos

@ darragh.delaney...Thank you for responding and for providing the alternatives. Are you then saying there is NO solution to this problem WITHOUT investing and integrating a third party software?

0 Kudos