Faddom discovery is based on passive network capture. It is possible to use full capture or statistical capture (NetFlow/sFlow) or a combination of the two modes. The Faddom component that captures traffic is called Faddom Sensor.
The selection of a deployment method depends on the Data Center network topology. It is possible to combine multiple modes in a single deployment.
How The Sensor Works
Faddom Sensor continuously captures TCP/IP packets that arrive on any of the network cards of the server on which it is installed.
The Faddom Server periodically connects to the sensor to receive traffic statistics. The sensor does not replicate data – instead, it sends only a statistical summary of the Faddom Server data.
The Faddom Sensor does not store data on disk. It keeps its data in memory for a limited time of up to 4 minutes.
Full Capture Versus Statistical Capture
Faddom can work based on NetFlow/sFlow statistical capture or based on full capture. NetFlow/sFlow deployment is usually quicker and should be considered whenever possible.
However, full capture provides a few more features.