Monitoring ports

This page provides the flow monitoring port management. The monitoring port is a process running over each monitoring interface. It analyzes every single received packet and computes flow statistics. The statistics are exported to a collector (for example, Flowmon Collector or the probe's built-in collector). The administrator can check the status of monitoring ports, start/stop monitoring ports, or set a new configuration. Each monitoring port is configured by a dedicated management panel or it can be switched to the global mode in which some tabs will be configured according to the Global settings.

Targets - Global Settings

Active timeout ensures that the very long flows will be exported in a specified time. Timeout is checked for each incoming packet. If the corresponding flow is lasting longer than the specified time interval, it is deleted from the flow cache and exported to the collector.

Inactive timeout avoids keeping old, inactive flow records in the flow cache forever. When no packets belonging to the flow are observed for the specified time interval, the flow record is exported to the collector.

The Output interface index is used by flow-exporting routers to specify the output interface of flow. Since the probe is only receiving data, this value has no sense of it and for this reason, it is populated as zero by default. However, some third party collectors can consider such flows invalid - in this case, it is necessary for the probe to set this value somehow. You can configure this value manually or it can be set automatically to the value of the input interface on which the flow was received.

Monitoring port buttons

To start the flow monitoring port click Start. If the monitoring port starts correctly, the button Start changes to Stop and the button Set Defaults changes to Restart. To use the default monitoring port configuration, stop it and then click Set Defaults.

Targets

In the Targets tab, you can configure various numbers of targets (that is, collectors) where the flow exports are to be exported. The targets can be added or removed by clicking New target or Delete. The maximum number of targets in each Monitoring port is 64. Every target is specified by the items Target address and Collector port. The address item is an address to a collector. If the probe built-in collector is to be used, use the address localhost. The port item specifies the listener port of the collector. For the built-in collector use port 3000. The Flow sampling rate value defines a deterministic sampling (for example, sampling interval 1 in 3 flows) for monitoring port flows. If you enter an N value, every Nth flow will be exported. This is useful in situations when the collector is overloaded by incoming flows. The zero value disables this feature. The Network protocol option can be selected in the corresponding drop-down menu. UDP (default) or TCP can be selected as the protocol. The TCP protocol is supported for the IPFIX export protocol only. If TCP is selected as the network protocol, the encryption TCP/TLS can be enabled. For TCP/TLS, the set of keys and certificates have to be generated for the flow exporting device (monitoring port) and collector. All certificates must be signed by the same certification authority (CA). Its certificate (CA certificate) must be provided together with the monitoring port key and certificate to each monitoring port target using TCP/TLS protocol. The provided key(s) must not be encrypted.

By selecting Use a filter for this target toggle switch, you can specify filters, which will be applied for individual targets. You can write a filter in the text box or pick and modify the saved filter from the Use and modify sample filter drop-down menu. To apply filters, click Ok. The monitoring port filter syntax is described in the section Monitoring port filter syntax.

In the Export protocol tab, you can select the Export protocol NetFlow v5, NetFlow v9, or IPFIX. If you disable the Use custom settings toggle switch and click OK, this tab is configured according to the global configuration. Additionally, the frequency of sending the template can be configured.