This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Replicated NetFlow

Since we send the NetFlow streams to 2 different systems I wondered if Orion can handle streams sent to it from a replicator device?  For instance we also have Arbor that can replicate the data and forward it on. We are trying this without any luck.

Basically we want to send 1 stream and have Arbor forward that to us as well.  The data should be good still.

BB

  • Hi,

    You might want to give a quick try to Samplicator: http://www.switch.ch/network/downloads/tf-tant/samplicator/

    This small program receives UDP datagrams on a given port, and resends those datagrams to a specified set of receivers.

    HTH,

    Yann

  • Does Orion NCM not have the ability to forward the Netflow to the 2nd system such as QRadar

  • firehawk_350,

    As far as I know, the NTA is just a netflow collector.  It doesn't have any way to forward the netflow streams it receives to your QRadar box.  You can configure netflow (at least on Cisco boxes) to export to multiple destinations.  Just add another "ip flow-export destination" statement.

    Hope this helps.

  • kweise is correct, you can set you exporter (router or such) to export to a second IP. NTA does not do this.

  • This feature is often known as "flow fanout", and it would be nice if Orion NTA supported it. There are so many tools that want to receive flow records these days that it's almost a necessity as one's network grows.

  • Hi,

    If one of your flow repository boxen is linux, then I suggest you use flow-fanout.  Depending on how your repository is currently setup (ie. what software you are currently using to capture the flows), this is very simple to do.  The man page for flow-fanout has good information.  This is what I am using to send flows to my Orion instance.

    The config file to setup with your flow exporters and receivers is as follows.  I added in the comments in the parentheses to help explain it.  If you are unfamiliar with *nix, the comment lines begin with #.  Then again, if you are unfamiliar with linux, this prolly isn't for you.  ;-) 

    ***

    [imroot@yoursys ~]$ less /etc/sysconfig/flow-fanout

    # ftOptions: Use "-s" to enable spoofing

    ftOptions=-s

    # ftLocalAddress: defaults to all interfaces
    #
    # (This is the IP your exporters are sending flows to)

    ftLocalAddress=xxx.xxx.x.xx

    # ftDestinations: defaults to "0/127.0.0.1/9995"
    #
    # (These are where you are sending the flows to.  Must include home to keep copy of flows here.
    # You can have as many as your system will handle.)
    #
    # ftDestinations="0/127.0.0.1/9995"

    ftDestinations="0/127.0.0.1/9995 0/xxx.xxx.xxx.xxx/9995"

    # ftRemoteSenders: defaults to "0:9996"; may specify multiple separated by space,
    #
    # (These are your flow exporters.  You can have as many as your system will handle)

    ftRemoteSenders="\
    yyy.yyy.y.y:9982 yyy.yyy.yyy.y:9983 \
    yyy.yyy.y.yyy:9985"

    ***

    Anytime you make changes to this config file, you'll need to bounce the flow-fanout service.

    [imroot@yoursys ~]# service flow-fanout restart

  • I think we all agree that NTA is a collector only.  The fact is more and more tools need Netflow data.  Cisco has a 2 destination limit and just adding a 2nd destination isn't always the right answer.  If you have over 2 collection machines then your out of luck.  Netflow can be a WAN hog so if you need to send it to 2 systems across the WAN your doubling the exact same traffic.  In a hub and spoke network, like mine, that's not an attractive solution.  Since, in our network, the Netflow receivers like NTA sit in the same network it would make sense to send 1 flow over the WAN and it can be replicated on the LAN.

    So add me to the list that would like to see NTA be a flow redirector/replicator.

    BB

  • I feel your pain with the slower spokes in a network.  In my network, we have some remote sites serviced by frame relay satellite uplinks.  Most of these sites have only 1 or 2 T1s, with all of the latency that comes with satellite.  In these cases, we had to set up a cheapo flow collector system at each remote site.  This is nice because you can copy the remote site flow data to your main flow repository in your core network late at night.  Not sure if Orion would be able to import and aggregate flows in this manner, tho...?  I apologize if this isn't helping, I've just delved into NetFlow with Orion and am still learning.

    Also, I do not understand how having Orion be a flow replicator is better?  You would be using Orion to do what I and others have suggested, thereby creating the same WAN traffic problem?  And would this not also cause more load to an already busy polling engine?

  • War Bird was exactly right in his comments and suggestions. There are a number of free, open-source "fan-out" solutions that can be installed to a relatively low-end server running some version of Linux.

    Even though you can configure a Cisco router to send duplicate copies of NetFlow streams to two different destinations, you would be foolish to do this. Why send duplicate (or triplicate) copies of the same NetFlow streams across precious WAN links.

    You should configure each of your routers to send their NetFlow streams to a single "fan-out" box which in turn can redistribute copies of those NetFlow streams to each and every NetFlow analysis tool that you might wish to use.

    We collect NetFlow streams from about 250 routers and redirect those streams to NetQoS Reporter Analyzer, Plixer Scrutinizer, Solarwinds NetFlow Traffic Analyzer. However because of the high cost and licensing per interface of NetQoS Reporter Analyzer, we also have implemented a solution in which we use different port designations in the router configurations to act as policy proxies so that the fan-out box will forward all streams to the NetFlow Traffic Analyzer and Scrutinizer software but only some streams to the Reporter Analyzer software.

    You can do a Google search to easily find free, open source software to run the 'fan-out' process; and it doesn't take a 'rocket scientist' to figure out the Linux OS on which to run the 'fan-out' service.

    http://linux.softpedia.com/get/System/Networking/flowtools-13642.shtml

    Hi, if one of your flow repository boxen is linux, then I suggest you use flow-fanout.  Depending on how your repository is currently setup (ie. what software you are currently using to capture the flows), this is very simple to do.  The man page for flow-fanout has good information.  This is what I am using to send flows to my Orion instance. The config file to setup with your flow exporters and receivers is as follows.  I added in the comments in the parentheses to help explain it.  If you are unfamiliar with *nix, the comment lines begin with #.  Then again, if you are unfamiliar with linux, this prolly isn't for you.  ;-)  ***

    [imroot@yoursys ~]$ less /etc/sysconfig/flow-fanout
    # ftOptions: Use "-s" to enable spoofing
    ftOptions=-s
    # ftLocalAddress: defaults to all interfaces
    #
    # (This is the IP your exporters are sending flows to)
    ftLocalAddress=xxx.xxx.x.xx
    # ftDestinations: defaults to "0/127.0.0.1/9995"
    #
    # (These are where you are sending the flows to.  Must include home to keep copy of flows here.
    # You can have as many as your system will handle.)
    #
    # ftDestinations="0/127.0.0.1/9995"
    ftDestinations="0/127.0.0.1/9995 0/xxx.xxx.xxx.xxx/9995"
    # ftRemoteSenders: defaults to "0:9996"; may specify multiple separated by space,
    #
    # (These are your flow exporters.  You can have as many as your system will handle)
    ftRemoteSenders="\
    yyy.yyy.y.y:9982 yyy.yyy.yyy.y:9983 \
    yyy.yyy.y.yyy:9985"

    ***

    Anytime you make changes to this config file, you'll need to bounce the flow-fanout service.

    [imroot@yoursys ~]# service flow-fanout restart