Support for sflow data

PROBLEM
How do I set up a sFlow Converter for Traverse


RESOLUTION

sFlow Collector for Traverse

● Overview
● Requirements
● Traverse Configuration
● sFlow Collector/Converter


Overview


Traverse includes a built­in Flow Collector that is capable of receiving NetFlow v5/v9
and IPFIX flow data. This flow data is used to identify "top­talkers" against a server or
particular port on a router/switch and provides powerful drill­down analysis and reporting
capabilities. NetFlow/IPFIX is supported by a wide range of equipment manufacturers,
including Cisco, Juniper, Nortel, VMware, Extreme. However, certain network equipment
manufacturers like HP, Fortinet, Force10, Enterasys only support sFlow, which is not
compatible with NetFlow data records. This document outlines how to setup a stand­alone
sFlow collector and use it to convert sFlow records into NetFlow data that is compatible
with Traverse.


Requirements

A command line tool called sflowtool provided by InMon (http://inmon.com) is included with Traverse under 'TRAVERSE_HOME\apps\silk\bin\', where 'TRAVERSE_HOME' is the installation folder.

Traverse Configuration

● Configure a new NetFlow version 5 source as outlined in the Traverse User Guide: http://help.kaseya.com/WebHelp/EN/tv/9050000/#17673.htm

sFlow Collector/Converter

Now that Traverse is configured to accept the (converted) NetFlow data, run the sflowtool
to create a listener for the sFlow data. To perform this, run the following commands on the
designated server:

● On Linux:
 sudo /usr/local/traverse/apps/silk/bin/sflowtool -4 -p 1305 -d 2055 -c a.b.c.d

● On Windows:
● "C:\Program Files (x86)\Traverse\apps\silk\bin\sflowtool.exe" -4 ­-p 1305 -­d 2055 -­c 127.0.0.1


At this stage, you should have a server with sFlow listener ready to accept data on UDP
port 1305, and a NetFlow listener that will receive converted data forwarded from this
server on UDP 2055. Since the NetFlow data will appear to be originating from the loopback interface, it will be necessary to set the 'Accept From IP Address' for the Flow Source configuration to be '127.0.0.1'.

The above steps are suitable for accepting/forwarding sFlow records from a single sFlow source.

APPLIES TO
All versions of Traverse

REFERENCE

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Contact us