1

I am trying to figure out which one of the three modes or all would support this. The sensor is a computer running fprobe and pushing UDP traffic (netflow v5) to an IP address in the network.

My question is, do any of these modes allow for packets coming out from the sensor machine to traverse the network.

  • SPAN port
  • Inline mode
  • Tap mode

If not how else can you monitor traffic passively using a sensor that runs fprobe and pushing flow to a computer with a known ip address that collects all data?

Improve this question
2
  • I'm not sure I understand. Is the sensor doing the monitoring, or are you trying to monitor its traffic? Are you wanting to report to a NetFlow server (usually done from a switch or router)?
    – Ron Maupin ♦
    Jan 20, 2018 at 4:39
  • So the sensor will monitor network traffic and then send the collected netflows to another machine on the network. The sensor is doing the monitoring. The collector machine is machine that would listen for udp packets coming on a specific port from the sensor. Does this make sense?
    – Michael
    Jan 20, 2018 at 4:54

1 Answer 1

Reset to default
1

The real way to do this is to configure NetFlow on your network devices (routers and switches).

If you insist on using a sensor for this, you will need to use SPAN if you have a single switch, RSPAN for multiple switches connected by layer-2, or ERSPAN for layer-3 separated switches.

Improve this answer
2
  • So outgoing packets from a device connected to a SPAN is possible but not for inline or tap? The reason why I insist on this method is that the sensor could also run IDS. It needs to get all the traffic, process and then sent logs (e.g., using rsyslogd) to another computer that can collect these logs. So, span is not a black hole that no packets can be send out from. Is this correct?
    – Michael
    Jan 20, 2018 at 16:33
  • The problem with inline or tap is that not all traffic flows over the single link you are observing. SPAN (and it variants) can get all the traffic. The limitation will be what the interface to which you send the traffic can handle. For example, capturing 20 Gbps from 100 other interfaces, you will drop 95% of the captured traffic if you send that to a 1 Gbps interface, or drop 50% to a 10 Gbps interface.
    – Ron Maupin ♦
    Jan 20, 2018 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.