Using Router as Netflow Probe

menit · ‎05-21-2017

Hi All

I have Backbone switch that not support Netflow.

i want to use my extra router to act as netflow device by making span on my backbone switch to the router and force my router to sent the netflow data to my netflow monitor server.

somebody did it and can help me with this?

Thanks

Peter Paluch · ‎05-22-2017

Hello,

Unfortunately, I am afraid that this won't work. A router will generate NetFlow records only for traffic that is in fact being routed by it. If you just connect a router to a SPAN egress interface, the router will not even bother looking at the traffic because the destination MAC addresses will not match the MAC address of the router's interface.

I am afraid that you would need a different solution. There are some OpenSource-based solutions that can run on dedicated hosts connected to SPAN egress interfaces, such as nProbe:

http://www.ntop.org/products/netflow/nprobe/

I am sure there are also commercial solutions available, but truth be told, I have not tried any myself, so I cannot provide a first-hand experience.

Best regards,
Peter