Mixed NetFlow version collection

slobodanL — Mon, 14 May 2018 14:00:19 GMT

Hi all,

Can someone tell me is it possible to collect flows from exporters with a different NetFlow versions (in my case I have exporters with Netflow version 5 and version 9, and I am getting flows from sources configured with version 5). So far I didn't get any flows from exporters with version 9. Is there a configuration option which enables/disables Netflow version.

Thank you

Re: Mixed NetFlow version collection

jamegill — Mon, 14 May 2018 14:32:20 GMT

Hi slobodan.lakic@telegroup.ba ,

There is no problem with collecting flow of different versions from exporters. In the Stealthwatch Desktop Client, the NetFlow Collection Status table includes a column for "Flow Types" and will show you the version received from the exporter; NetFlow v9, NetFlow v5, IPFIX, etc.

If you're having problems with the v9 configuration, make sure you are collecting all of the requisite datapoints:

• Source IP

• Destination IP

• Source Port

• Destination Port

• IP Protocol

• Packet Count

• Byte Count

• Time first seen

• Time last seen

For reference, check the NetFlow Configuration Guide for your version of operating system.

--jg

topic Re: Mixed NetFlow version collection in Security Analytics

Mixed NetFlow version collection

Re: Mixed NetFlow version collection