topic Re: FlowCollector sizing in Security Analytics

FlowCollector sizing

dejan.malisanovic@telegroup.ba — Sun, 06 Aug 2017 21:13:38 GMT

How to make good sizing for FlowCollector Virtual appliance for several Cisco Nexus 7710 switches?

How many FPS is needed?

Re: FlowCollector sizing

brford — Mon, 14 Aug 2017 22:17:47 GMT

Dejan,

First make sure that your Nexus 7K supports Flexible NetFlow. That dependent on the software it's running. Next figure out what interfaces you want to export flow for. On the 7K that's usually VLANs. The 7K can generate a lot of flow records because it moves a lot of traffic. Finally check out this site:

Free Visibility Assessment - Cisco

Fill out that form and request the Stealthwatch UDP Director trail. You'll be contacted via email with download and install instructions for the UDP Director. Once that is set up and NetFlow from your 7Ks is exported to it; the UDP Director will report on how many flows are being exported.

I hope this helps.

Brian

Re: FlowCollector sizing

chrisgr2 — Thu, 17 Aug 2017 14:47:33 GMT

Dejan,

In addition to the information Brian provided on how to get an eval UDPD so you can measure the volume of flows that your Nexus will generate, our documentation for the FC virtual appliance details the resource requirements that the vm will need based on several factors such as the fps rate, number of exporters and host count.

Here is the relevant information from the FCVE installation guide:

Let us know if there are any further questions regarding the sizing requirements of the FCVE's.

Chris

Sr StealthWatch Support Engineer