01-06-2018 01:14 AM
Hi all
we have nexus 7k switches with f3 line card configured exporter sampler netflow data to Stealthwatch 6.9.2.
The problem explain,
Stealthwatch showing less data on interface inbound traffic comparing to SNMP interface statics for example WAN interface has 300Mbps but stealthwatch collect up to 100 mbps with netflow.
we can see no more than 100 Mpbs sampler mode 1 out of 1
we do not see any traffic while sampler mode 1:1000
and we can not seen any sampler configuraiton on flow collector and stealhwatch console.
which is the problem ? nexus or swtealthwatch ?
do you have any experiance with similar problem ?
Solved! Go to Solution.
04-23-2018 11:13 AM
Hi brford
thanks for your suggestions
we have solved this issue by entering sample rate same as nexus side on the Flow Collector .
for your info.
04-02-2018 08:42 AM
The issue may be the result of the use of sampled NetFlow (rather than full or un-sampled NetFlow). The interface statistics produced in Stealthwatch when using sampled NetFlow are an approximation of the traffic based on the sampling rate and the sampling type (random or deterministic). The statistics reported at the command line interface (CLI) of a device are often exact.
In this network the NetFlow sampled data generated by the Nexus switch can contribute to behavioral analytics but really can't be the only data source. You can greatly improve Stealthwatch findings by adding exporters that support full, un-sampled NetFlow elsewhere in the network.
04-23-2018 11:13 AM
Hi brford
thanks for your suggestions
we have solved this issue by entering sample rate same as nexus side on the Flow Collector .
for your info.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide