Is netflow from fprobe supported?

Question

Hi all,

I have a linux server that is collecting pcap data and converting that to netflows with fprobe. I am not seeing the flows show up in the Orion Netflow. Is this even supported?

Maybe I am not adding the monitored device into Orion correctly. How would I do that since the linux server is not a network device? Do I have to enable SNMP on it as well to add it as a device?

Thanks!!

justin_wyllys · Accepted Answer

Hi awesome_opossum,

I just spoke with a customer who was able to get flows to show up in NTA from FProbe on their linux box using two processes (one for in, one for out; designed for high load):

/usr/local/fprobe/sbin/fprobe -x1:2 -ieth1 -B4096 -r2 -q10000 -t10000:10000000 -a 1.1.1.1 2.2.2.2:2055

/usr/local/fprobe/sbin/fprobe -x2:1 -ieth1 -B4096 -r2 -q10000 -t10000:10000000 -a 1.1.1.1 2.2.2.2:2055

1.1.1.1 = Source IP

2.2.2.2 = NetFlow collector IP

2055 = Collector port

X1:2 (InPackets)

X2:1 (OutPackets)

Hopefully this helps!