Stealthwatch export from sensor?

[Scott.ODonnell@gmail.com]

All ,

I'm looking to see if it's possible to leverage flow information collected by a stealthwatch sensor in another application.

Based on my research , the stealthwatch sensor will provide flow information including application layer information like URL, etc.

I'm trying to avoid having to place yet another span collector into the environment.

Is it possible to glean this information from Stealthwatch?

If so, what format would it be in?

-Scott

[brford]

Scott,

The current version (6.9) of Stealthwatch Flow Sensor exports data in IPFIX format.

I hope this helps.

Brian

[Scott.ODonnell@gmail.com]

Thanks for the reply Brian.

Is there a sample export or documentation that details the included information?

-Scott

[jamegill · Accepted solution]

The Stealthwatch Flow Sensor exports data in IPFIX format (see RFCs 7011, 7012).   Any  system that can consume IPFIX (or NetFlow or any of the compatible formats) should be able to consume it.   Some of the datapoints encoded in the Flow Sensor's data are recorded in "enterprise fields". Those fields which are publicly labeled will use IANA standard IP Flow Information Export (IPFIX) Entities.