Can multiple netflow exporters use same collector port name?

Question

As per my knowledge, each exporter(Netflow packets from server1, Netflow packets from server2...) have a destination collector port(single nfcap daemon). So, is there any way to configure multiple exporters can point to single collector?. If yes, how can we differentiate the records. For eg. If server1->nfcap(PORT:6003), server2->nfcap(PORT:6003), server3->nfcap(PORT:6003) scenario is like this, how can I identify the netflow data(Data from server1->save the file as nfcap.server.data). Thanks!

Answer 1

A NetFlow collector can be the collector for many devices. The collector knows where each record comes from by the source address of the sender.

How does a web server know which host to reply to when thousands or millions of hosts send it requests on the same port? It's the same thing.

How the collected records are presented is up to the application you are using to view them.

Answer 2

One smart capture daemon should be able to distinguish multiple exporters by the exporter address. However, your actual capture tool is likely to restrict what you can achieve.

For instance, nfcapd seems designed so that you should run a distinct nfcapd daemon for every exporter.

So, if you can't change the UDP destination port, perhaps you can use multiple IP address?

Run each nfcapd daemon on a distinct address, like this:

• exporter1 -> nfcapd (port 6003, address 1.1.1.1)
• exporter2 -> nfcapd (port 6003, address 1.1.1.2)
• exporter3 -> nfcapd (port 6003, address 1.1.1.3)