We use nProbe/nTopNG as our main netflow monitoring tool. It uses the standard netflow fields that most flow monitoring systems use.
DNAC/Catalyst center however, provisions the AVC flow capture which most other systems don't know how to read.
I spent some time working on a a flow record that uses a combination of the match/collect fields from both, that sends to both my dnac exporter and nprobe exporter. Both dnac and nprobe then get the info they need (and ignore the other fields) and I only need one monitor on the interface.
Our existing flow record:
flow record FNF-input
description IPv4 NetFlow
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match ipv4 protocol
match interface input
match ipv4 tos
match flow direction
collect interface output
collect counter bytes long
collect counter packets long
collect transport tcp flags
collect timestamp absolute first
collect timestamp absolute last
flow record FNF-output
description IPv4 NetFlow
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match ipv4 protocol
match interface output
match ipv4 tos
match flow direction
collect interface input
collect counter bytes long
collect counter packets long
collect transport tcp flags
collect timestamp absolute first
collect timestamp absolute last
My new flow record that uses the DNAC provisioned record but adds the required 'collect' fields for nProbe:
flow record nProbeExtended
description nProbe essentials with extended AVC for dnac
match ipv4 version
match ipv4 protocol
match application name
match connection client ipv4 address
match connection server ipv4 address
match connection server transport port
match flow observation point
collect timestamp absolute first
collect timestamp absolute last
collect flow direction
collect connection initiator
collect connection client counter packets long
collect connection client counter bytes network long
collect connection server counter packets long
collect connection server counter bytes network long
collect connection new-connections
collect datalink mac source address input
collect counter bytes long
collect counter packets long
collect transport tcp flags
collect transport source-port
collect ipv4 source address
collect transport destination-port
collect ipv4 destination address
collect interface input
collect interface output
And then I just list both exporters in the monitor field:
flow monitor nProbeMonitor
exporter nProbeExporter
exporter dnacexporter
cache timeout inactive 10
cache timeout active 60
record nProbeExtended
And then add the monitor to the interface for both input and output if required.
