3

As per my knowledge, each exporter(Netflow packets from server1, Netflow packets from server2...) have a destination collector port(single nfcap daemon). So, is there any way to configure multiple exporters can point to single collector?. If yes, how can we differentiate the records. For eg. If server1->nfcap(PORT:6003), server2->nfcap(PORT:6003), server3->nfcap(PORT:6003) scenario is like this, how can I identify the netflow data(Data from server1->save the file as nfcap.server.data). Thanks!

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin
    Aug 6, 2017 at 22:37

2 Answers 2

1

A NetFlow collector can be the collector for many devices. The collector knows where each record comes from by the source address of the sender.

How does a web server know which host to reply to when thousands or millions of hosts send it requests on the same port? It's the same thing.

How the collected records are presented is up to the application you are using to view them.

0

One smart capture daemon should be able to distinguish multiple exporters by the exporter address. However, your actual capture tool is likely to restrict what you can achieve.

For instance, nfcapd seems designed so that you should run a distinct nfcapd daemon for every exporter.

So, if you can't change the UDP destination port, perhaps you can use multiple IP address?

Run each nfcapd daemon on a distinct address, like this:

  • exporter1 -> nfcapd (port 6003, address 1.1.1.1)
  • exporter2 -> nfcapd (port 6003, address 1.1.1.2)
  • exporter3 -> nfcapd (port 6003, address 1.1.1.3)
1
  • nfcapd can support an arbitrary number of exporters, but you need to know them ahead of time when you start it (you can specify multiple -n settings, and they will work) Dec 2, 2016 at 1:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.