Faddom Help Center

How to capture Netflow in case it's in use?

NetFlow capture may already be in use by other tools in the environment.

Since Faddom sensors do not require the NetFlow traffic to be sent directly to them, you can use the built-in mirroring capabilities of the VMware distributed switches to mirror the NetFlow traffic to Faddom to allow it to capture the traffic without affecting the other tools.

Create a port mirroring session using the following method:
  1. Open the VMware web console and navigate the distributed switch on which the tool receiving the NetFlow is residing
  2. Open the configuration tab and select Port Mirroring
  3. Create a new port mirroring session using the following details:
    1. Select the Encapsulated Remote Mirroring session type
    2. In the properties, set the status To Enabled
    3. In the Select sources section, select the tool that is currently receiving NetFlow
    4. In the Select destinations section, enter the IP address of a Faddom sensor
  4. Faddom should now receive all the same NetFlow traffic as your other tool
Was this article helpful?
0 out of 0 found this helpful