Monitoring Multiple Sources

[LAPFCU]

If I understand correctly, we can only assign one UDP port per device for NNA. Does this mean when I configure my network device to send flows to NNA, I have to configure each port I want to monitor to that UDP port, and then analyze it by using queries? OR do I just configure it in one area and then analyze by queries?

Could someone give me a more clear understanding of this? As of right now, we picked a port we felt had a lot of traffic on two of our Nexus 3ks and one port on our large core switch stack and configured each port to send to a unique UDP port. Then we added them by port into NNA.

Any clarity would be greatly appreciated.

[scottwilkerson]

When you configure your devide to send netflow or sflow data to Nagios Network Analyzer you are sending everything from the device, not on a per port basis.

Nagios Network Analyzer collects all the information and then you can use queries to filter to see what you want to see

[LAPFCU]

I guess I'm a little confused, if you could just bare with me. When you set up NetFlow on a Cisco device, theres a point in which you set the interface, after the collector has already been set:

Code: Select all

Router(config)# interface ethernet 0/0

If this is not setting flow export for only this interface what is it doing? How is selecting a singular int relevant in send data for the whole device?

[scottwilkerson]

As far as I am aware, you cannot set a different destination for the ports you are monitoring

Ref
https://assets.nagios.com/downloads/nag ... alyzer.pdf

[LAPFCU]

Heh, if I felt the documentation was clear, I wouldn't be here!

2nd Page Says: "You will need to enable Netflow on each individual interface that you want to collect statistics on. I"

The section in regards to the 4500 (which is what we have) says: "This example only
sends the flow information for the interface called GigabitEthernet 1/3/1"

Your first response says: "When you configure your devide to send netflow or sflow data to Nagios Network Analyzer you are sending everything from the device, not on a per port basis."

This all implies otherwise to your response. If the data was for the entire device, all int ports would be configured with the same information, or there would be a general configuration in the start/run config. Are there any NNA specialist, that can provide clear information? Or maybe an engineer on the NNA team. I have searched far and wide and my conclusion for the NNA product is that very few, if any, people actually have a clear understanding on how NNA actually works in regards to configuring and monitoring.

I need to know, do i configure all int ports to point to one unique UDP port for NNA and break down my analysis with queries and reports. Is there some special way to point the entire device at one unique UDP port for NNA, then break down my analysis with queries and reports. Do i configure each int port to a unique UDP port for NNA and monitor them individually?

I havent been able to find a clear enough answer for this anywhere. It seems I cant find anyone who is monitoring as much as we are with NNA.

[scottwilkerson]

Using the example for the 4500, you would run the following on each interface you want to send flow data from

Code: Select all

ip flow monitor m1 layer2-switched input

[LAPFCU]

Ok excellent. Thank you for pointing that out. Would you agree then, in order to monitor 'everything', we would configure that to every port that covers 'everything' from that switch?

Thanks again!

[scottwilkerson]

Ok excellent. Thank you for pointing that out. Would you agree then, in order to monitor 'everything', we would configure that to every port that covers 'everything' from that switch?

Thanks again!

Yes, however we have many organizations that only monitor either the ingress or egress port and not inter-switch communications. Every organization is different.