Enable Flow Technologies

Flow Source Flow Timeout Configuration

The typical manufacturer setting is for a router to send flow data every 30 minutes. Sometimes referred to as the flow cache timeout, this setting defines the frequency that a router sends the flow table to the collector (SevOne NMS). This implicitly is the limit to which the router allows a flow to grow before breaking the flow into a new flow.

SevOne recommends that you configure routers to send flow data every one minute in order to have the router report to SevOne NMS in a timely manner that enables the even distribution of information transfer. Should you choose to set the flow source flow timeout configuration to something other than one minutes, the router reports less frequently and sends SevOne NMS larger flow tables which results in less granular report data. To compensate for this, SevOne NMS FlowFalcon reports provide a Granularity setting that enables you to view the report at the granularity that matches your router flow timeout configuration. A flow cache timeout other than one minute is not recommended.

The SevOne NMS Cluster Manager > Cluster Settings tab provide a Drop Long Flows option that enables you to define a time limit for what you consider to be a long flow. When you use the Drop Long Flow option, SevOne NMS hides the traffic from routers that send flows that exceed the Max Flow Duration you enter. When a router sends flows that exceed the Max Flow Duration, an administrative message appears upon log on to inform administrators that flows from a specific router have been dropped. The Drop Long Flows feature is useful when you set the router cache timeout to be shorter than the Max Flow Duration you set in SevOne NMS, because long flows would then indicate that a router is misconfigured.

The Cluster Manager > Cluster Settings tab provides the ability to adjust the interval at which SevOne NMS writes flow data to the database. The write interval sets the time window for which raw data is to be aggregated into the minimal aggregation. The Write Interval should be set to one minute. In the rare situation where you decide to change this setting, you should consider that every hour SevOne NMS takes flow data and creates 15 minute aggregations for the top <n> flows for each interface and view. Your Write Interval setting should therefore be divisible by 15 when you intend to use aggregated flow data.

Cisco IOS Router

Cisco Switches Running CatOS (Hybrid Mode)

4000 Series Catalyst Running in Hybrid or Native Mode

This series requires a Supervisor Engine IV with a NetFlow Services daughter card to support NDE.

Configure sFlow Features from the CLI

You configure sFlow technology, designed to monitor high speed switched or routed networks, to continuously monitor traffic at wire speed on all interfaces simultaneously.

1. Enter the following command to configure the IP address of the SevOne NMS appliance.

   [edit protocols sflow]

   user@switch# set collector <SevOne-IP>

2. Enter the following command to configure the UDP port on the collector. The default UDP port on SevOne NMS is 6343.

   [edit protocols sflow]

   [edit protocols sflow] 6343

3. Enable sFlow technology on a specific interface.

   [edit protocols sflow]

   user@switch# set interfaces interface-name

   You cannot enable sFlow technology on a Layer 3 VLAN-tagged interface. You cannot enable sFlow technology on a LAG interface. sFlow technology can be enabled on the member interfaces of the LAG.

4. Enter the following command to specify how often the sFlow agent polls the interface.

   [edit protocols sflow]

   user@switch# set polling-interval seconds

   Enter 0 (zero) to not poll the interface.

5. Enter the following command to specify the rate at which to sample packets.

   [edit protocols sflow]

   user@switch# set sample-rate number

6. You can also configure the polling interval and sample rate at the interface level. The interface level configuration overrides the global configuration.

   [edit protocols sflow interfaces]

   user@switch# set polling-interval seconds

   [edit protocols sflow interfaces]

   user@switch# set sample-rate number

Juniper Switch

The following configuration enables sFlow monitoring for all interfaces on a Juniper EX switch, sampling packets at 1-in-500, polling counters every 30 seconds and sending the sFlow to SevOne NMS <SevOne-IP> on UDP port 6343.

Specify cflowd Options on an IP Interface

Enter the following command.

Depending on the option selected, either acl or interface, cflowd extracts traffic flow samples from an IP filter or an interface for analysis. All packets forwarded by the interface are analyzed according to the cflowd configuration.

Enable the acl option to enable traffic sampling on an IP filter. You must enable Cflowd (filter-sample) in at least one IP filter entry.
Select the interface option to enable traffic sampling on an interface. If cflowd is not enabled (no cflowd) then traffic sampling does not occur on the interface.

Check for Traffic

If flow data does not display for the device, confirm that SevOne NMS actually receives the data via tcpdump.

Log in to the box and run one of the following commands.

1. Enter the following command to show all incoming flow traffic to SevOne NMS.

   $ tcpdump -i eth0 port 9996

2. Enter the following command to show only flow traffic from a specific IP address.

   $ tcpdump -i eth0 port 9996 | grep '<ip address in question>'

3. If data comes into SevOne NMS, you should eventually see a message similar to the following:

   Example

   17:55:47.934113 IP <ip address question>.49359 > \ <SevOne>.9996: UDP, length 1464

4. If no data comes in from the IP address, there may be a routing issue.

Check the Version

If flow data comes in, but nothing displays, the version may be wrong.

Enter the following command to dump the first portions of the packets to the page.