Skip to main content

Flow Sampling Configuration

There are several sections in the TOML dedicated to configuring how you receive flow samples from other network devices. At a minimum, you should configure the ports directive for either NetFlow (or one of its variants) or sFlow.

info

These configuration items affect the opening of relevant ports and behavior on Director only. In order to actually send flow samples to Director, you will need to configure your network devices to send these samples to the management address you've configured for Director and the destination ports you've specified in the ports sections.

NetFlow v5, v9, ipfix​

# NetFlow section enables NetFlow v5, NetFlow v9, and IPFIX support.
[netflow]
# UDP ports to listen on for NetFlow data
# Below are two of the most common NetFlow Ports
ports = [2055, 9996]

# Optional, Default true
netflow-v9-lite = true

# Optional, Default true
netflow-ipfix-inline = true
  • ports: If using NetFlow (any version), at a minimum the UDP ports you intend to send the samples to from your network devices should be specified in the ports directive.
  • netflow-v9-lite: If you need to process NetFlow v9 Lite samples, set this flag to true.
  • netflow-ipfix-inline: If you need to process IPFIX flow samples, set this flag to true.

sFlow​

[sflow]
# UDP ports to listen on for sFlow data
# Below is the IANA assigned sFlow port
ports = [6343]

# Strip external GRE tunnel before processing.
# Optional, default false
strip-tunnel = true
  • ports: If using sFlow, at a minimum the UDP ports you intend to send the samples to from your network devices should be specified in the ports directive.
  • strip-tunnel: An optional flag that, when set to true, strips external GRE data before processing flow samples.

Flow sampling engine configuration​

[engine]
# Buffer size for incoming flow data. Increasing this will take more memory,
# but store more incoming flows. This buffer is used to speed up attack detection.
# Set to zero to disable traffic buffering.
# Optional, defaults to 100000
traffic-buffer-size = 100_000

# Time window in seconds for calculating moving average rates. The default is
# appropriate for packet-sample based flow ingestion (such as sFlow). Must be
# set higher than any exporter's timeout intervals when using any flow-based
# ingestion methods.
# Optional, defaults to 5 (seconds)
average-calculation-time = 5
  • traffic-buffer-size: This advanced configuration affects the buffer size allocated for processing incoming flows. In most cases, you should not need to specify or modify this value.
  • average-calculation-time: This advanced configuration changes how the moving average is calculated for ongoing traffic. If using packet-based samples you likely won't need to adjust this. If using flow-based samples, you should adjust this value to be slightly higher than the active and inactive timeout interval values set on your flow exporter.