Sources

This page manages all flow sources, which send at least one flow packet to Monitoring Center. These sources are automatically added at the moment of the first flow packet reception. If an SNMP info check is allowed, then the information about its name, network interfaces, speed, and status is automatically read from each source. This information is updated every hour. If a device has enough resources, then a new profile is created in the Sources group using this information (the profiled source is created). This profile can contain channels for a limited number of network interfaces on this source (profiled interfaces). The new source is also added to the "All Sources" profile. For each source, the live check operation can be enabled. This operation checks every 5 minutes whether the flow source is responding.

Sources can be displayed in two modes - the panel mode and table mode. The panel mode shows only the profiled sources and each source panel contains a traffic graph and list of network interfaces obtained by SNMP (the list of interfaces is hidden by default and can be shown by clicking on a small triangle icon at the bottom of each panel). You can switch the interface into the profiled state by ticking the checkbox of this interface and clicking Save changes. This creates a new channel for this interface. You can perform a search using a text field and a drop-down menu above the interface list. By clicking the Edit link you can change the SNMP parameters for reading the status of this source. If you click the Delete link, the source is deleted. If there are still new flow packets coming from this source, the source will be added again at the moment of FMC or device restart. You can rename the interface by right-clicking on its name.

The table mode view (see picture below) is useful if there is a large number of flow sources. Clicking Detail opens a form with the same content as in the panel mode view. In the table view, you can switch the source into non-profiled mode by unchecking the allowed/stopped toggle switch (for a profiled source) in the status column so that it says "stopped". If there are enough resources, you can turn a non-profiled source into a profiled one by switching the toggle to "allowed". The Edit and Delete buttons have the same function as in the panel mode.

The total number of profiled or non-profiled sources and their interfaces is shown in the page header. You can use the Configuration Center to set limits on the number of profiled sources and profiles interfaces you can have (see chapter Built-in Collector - Sources settings). If the source has no profiled interface (including AllPorts), it will be turned into non-profiled mode.

If a new source is detected and the limit is not reached, the new source will be added as a profiled source and the AllPorts channel will be configured as a profiled channel. Also, an info message is shown in the status icon. The AllPorts channel includes traffic from all interfaces. Selected source interfaces can be manually configured to the profiled state.

Information about the source is read automatically by the SNMP protocol (if enabled). The predefined settings are used when the source is first used. The settings can be changed by clicking Edit source defaults. In the dialog box, the SNMP connection can be enabled and the connection parameters can be set. It is possible to configure one or more default community strings. When a new source is detected, the system is trying the provided community strings in configured order until it is successfully connected. The right community string is then stored for this source and used again for the next connection. If none of the community strings is correct, then the connection is not successful. If SNMP data has not been obtained (because of an error or because this function was disabled by the user), the AllPorts channel is the only channel created.

The information about the source is refreshed regularly. The SNMP connection parameters can be set here. If the Use SNMP for determining the source information option is enabled, the function Enable flow source live check can be enabled too. This function tries every five minutes to read a hostname of the source by SNMP and if it is unsuccessful, it is reported using a status icon (which may lead to sending an email, syslog, or SNMP trap depending on the configuration). A similar check (Flow data live check) can be enabled on a source and it is checking the number of incoming flows to ensure that the configured criteria is met. It is possible to enable two conditions each being evaluated independently. The first one (Minimum flows) compares the number of flows in last the five-minute interval to the defined limit. The second condition % drop evaluates a percentage drop in the number of flows in the last 5, 10, or 15 minutes and is evaluated every 5 minutes. If any of the enabled conditions are not met, this fact is reported using a status icon, possibly triggering other actions listed in the SNMP live check description.