Skip to main content
All CollectionsGetting StartedData Sources Configuration
How to capture Netflow in case it's in use?
How to capture Netflow in case it's in use?
Alex Patnick avatar
Written by Alex Patnick
Updated over 9 months ago

NetFlow capture may already be in use by other tools in the environment.

Since Faddom sensors do not require the NetFlow traffic to be sent directly to them, you can use one of the two methods below to allow Faddom to receive the netflow traffic as well.

Promiscuous Mode

Promiscuous mode is a parameter that you can set for a port group in VMware that will allow that port group to see all traffic on a VLAN.

To enable this you should do the following:

  1. Deploy a Faddom Sensor VM in VMware. To get the sensor ova file, see here.

  2. Create an affinity rule in VMware to have the sensor always be on the same ESX host as the current Netflow collector

  3. Create a new port group for the Faddom sensor VM

    1. Set the VLAN to be the same VLAN as the current Netflow collector

    2. Enable promiscuous mode for the port group

  4. Add an additional network interface to the Faddom Sensor VM and connect that NIC to the new port group created above

  5. Log in to the Faddom Sensor and run the ~/configIp.sh script to configure the network interface

  6. Configure the Faddom Sensor in the Faddom UI in the Settings->Sensor Status screen

Port Mirroring

An additional option to duplicate the Netflow traffic is to use the built-in mirroring capabilities of the VMware distributed switches to mirror the NetFlow traffic to Faddom.

Create a port mirroring session using the following method:

  1. Open the VMware web console and navigate the distributed switch on which the tool receiving the NetFlow is residing

  2. Open the configuration tab and select Port Mirroring

  3. Create a new port mirroring session using the following details:

    1. Select the Encapsulated Remote Mirroring session type

    2. In the properties, set the status To Enabled

    3. In the Select sources section, select the tool that is currently receiving NetFlow

    4. In the Select destinations section, enter the IP address of a Faddom sensor

  4. Faddom should now receive all the same NetFlow traffic as your other tool

Did this answer your question?