Probe Configuration

Packet Capture

Connect to the web interface of your probe and click Configuration Center on the main page. Then, click Monitoring Ports. Here you will find settings for each monitoring interface on your appliance.

Global Settings

The Global settings panel shows all the options for each monitoring port and is used for their central configuration. The monitoring ports can be configured in one of the following two ways. You can either configure the port separately or choose a configuration set from the panel with global settings. This applies to all the available tabs - Targets, Export Protocol, Advanced Settings, and Packet Capture. The Global Packet Capture figure below shows the Packet Capture tab.

The Packet Capture tab allows you to configure the collector's IP address with the control and data collection ports, adaptive buffer, and filtering criteria that determine what rules the probe can process. Ports used for control and data collection have to match the configuration found in FPI Settings - Probe communication on the collector appliance. These settings can be then assigned to individual ports as needed.

When applying global settings while having some of the L2 criteria enabled (that is, MAC, MPLS, or VLAN), ensure that all the affected monitoring ports have the corresponding NetFlow record options enabled in the Advanced Settings tab. Otherwise, these global settings will not be applied.

When you turn on the Adaptive buffer, additional options will become available, as shown in the Adaptive buffer figure below. The adaptive buffer allows storing the first several packets (which usually contain the most important information about the communication) of every flow that passes through the monitoring port. These packets can be later included in the recording if there is a rule matching these packets. The adaptive buffer also works with recordings triggered by anomaly detection from Flowmon ADS (for more information, refer to the Flowmon ADS User Guide). Packets per flow specifies the number of first packets that are stored in the buffer per flow. Time to live determines how long these saved packets remain in the buffer (in seconds). Buffer size specifies the total number of packets that the buffer can ultimately hold. This dropdown list contains recommended and expert values. Recommended values are buffer sizes dedicated for general purposes, suitable for use with multiple modules installed. The expert values are dedicated to more specialized use cases with high flow count. These scenarios require much more memory, which is why it is recommended to only use them when the Flowmon Packet Investigator Probe is the only module installed on the appliance. The Filter field allows you to specify the rules that narrow down the number of flows from which the packets will be drawn and temporarily stored.

There can be multiple rules, each on a separate line. The rules will be combined as if connected by or conjunctions. A rule consists of one of the following expressions:

Adaptive buffer filters

ip <IP>
port <PORT>
mpls <MPLS tag>
vlan <VLAN tag>

These simple rules can be combined with the and conjunction into a composite rule. The first few packets of a flow that match these rules will be stored in the buffer. Here are some examples of such rules:

Adaptive buffer filter rule examples

ip 192.168.0.5 and port 23
vlan 3
port 65 and mpls 8

Clicking Save applies the changes made in the Packet Capture tab and restarts all monitoring ports.

Port Settings

Settings for each monitoring port can be modified in the Packet Capture tab as shown in the per-port packet capture figure below. This is where you can start or stop the probe. When the Use custom settings option is enabled, settings from the Global settings panel will be ignored and options specific for that particular monitoring port will appear - the collector appliance's IP address with control and data collection ports, adaptive buffer, and filtering criteria. Ports used for control and data collection must match the configuration found in FPI Settings - Probe communication on the collector appliance. Similar to the Global Settings panel, to be able to select the L2 criteria (MAC, MPLS or VLAN), corresponding NetFlow record options must be enabled in the Advanced Settings tab of the monitoring port.

Clicking Save applies the changes and restarts the monitoring port.

Time Synchronization

Probe and collector appliances must have their time synchronized. The collector appliance is used as a reference point and the probe appliances synchronize with it.

The time synchronization settings can be found in System - System Settings - Time zone; see the Time synchronization figure above. The Set time automatically option must be enabled and the NTP Server must match the IP address of your collector appliance. Ensure the selected Time zone is set according to the location of the appliance. Clicking Save applies the changes.