0

I'm currently working on replacing our existing Netflow collector that is EOL with a new one. The goal is to support around 4 million flows/minute and have HA capabilities. Below is my initial thought:

Network devices --> F5 Load Balancer --> 3 Linux servers running a collector --> Forward Netflow to other devices as needed

With this setup, I can easily grow the amount of flows on the server end as long as the F5 can support it. I also do not have to worry about 1 server going down as the F5 would take it out of the loop.

My main concern about this is the servers that the 3 servers forward to. If I forward 20 devices to X.X.X.X, I wouldn't assume there would be any issues on the backend as each UDP packet will contain multiple flows and 1 flow won't traverse multiple packets. Thoughts?

Also, I am planning on either using samplicator or flow-tools as the Netflow collector/forwarder. Originally I wanted to us nfdump but it does not appear to have the option to spoof the source IP address. Are there any other tools you would recommend I use instead?

Thanks in advance.

1 Answer 1

2

Regarding your question: each UDP packet will contain multiple flows and 1 flow won't traverse multiple packets.

Answer: a long-lived flow could be broken up into multiple datagrams (packets). Also, some high volume flow (i.e. IPFIX) exporting devices will round robin the export to multiple collectors. The front end of the distributed NetFlow collection solution should be able to tie the flows back together across multiple collectors into a single report.

BTW: when we tested the F5 export back in February 2014, it didn't provide octetDeltaCount which breaks most reporting solutions. Perhaps they have added it.

Does this help?

Jake

1
  • Yes it does. Thank you very much for your information. After digging into it a little more, I think a fairly standard RHEL VM with some optimization for UDP packets will support the flows I want without the load balancing portion of it. I may just have the F5 front end it for HA and not load balancing.
    – Eric
    Apr 1, 2015 at 17:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .