--- title: "Netflow Collector" canonical: "https://thoughtdata.refined.site/space/TUD/55643269/Netflow%20Collector" format: markdown --- ThoughtData's NetSense software can be setup as a passive netflow data collector used for network flow level performance monitoring. NetSense Netflow collector ingests netflow data exported by your netflow enabled routers/switches/firewall from your IT network and extracts rich IP flow level telemetry information(Key performance indicators/KPIs) from your network devices in real time. NetSense netflow collector can take Netflow data feeds from following netflow technologies and versions - Cisco Netflow v5, v7, v9 - IPFIX - SFlow - CFlow **Netflow Collector Performance ** Netflow data collection is highly resource intensive job and the performance of the netflow collector and its data collection largely depend on the resources provided to the NetSense netflow collector process. The performance of the NetSense netflow collector depends on the amount of flow volume ingested by the netflow collector from various netflow exporting devices targeted to NetSense netflow collector. Generally **A 4 CPU,16 GB RAM , 500GB HDD, 1 NIC physical or virtual machine is required for every 60,000 flows per minute or 1000 flows per second. The total flow volume is across all devices exporting netflow to NetSense netflow collector** Careful consideration has to be done in selecting the right network links on your network devices like routers, switches and firewalls which export netflow data to NetSense netflow collector. Only those critical links on network devices where you would need IP flow level visibility beyond link level visibility need to be enabled for optimized netflow monitoring. As most of the IP traffic hops from one link to another, enabling netflow on multiple links not only leads to duplicate and unwanted flows but also adds un necessary overhead on network devices as well as NetSense netflow collector and Enterprise360 in handing unwanted netflow data. The most common links where Netflow is enabled in IT networks are aggregated traffic links behind firewalls or WAN links but not on internal links  **Note: **Enabling netflow on network devices like Routers/Switches/Firewalls can have considerable performance overhead on the network devices as well as flow exporting links if not done carefully. Before attempting to setup/start NetSense netflow collector you must enable, configure and test netflow data export from your Router/Switch/Firewall. Refer to Advanced topics section under configuring NetSense for a sample illustration. Netflow configuration can vary drastically across multiple vendor class devices and flow version, formats and templates. Refer to your respective vendor user and administration guides to follow steps to configure and enable netflow on your network devices. **Static IP address for NetSense Netflow collector** It is recommended to configure a static IP address for NetSense netflow collector as this IP address will be required for configuration on network device side as well. Setting up NetSense netflow collector for IP address from a DHCP server might lead to changing IP address on NetSense netflow collector which might further lead to changing netflow configurations on the network devices side. Default Port on which NetSense netflow collector listens is UDP **9992** **Prerequisites before setting up NetSense netflow collector**: Netflow data export is enabled on your Router/Switch/Firewall and destination IP address has been configured as **NetSense IP address** and Destination Port has been configured as **9992** **Testing Netflow data collection in NetSense netflow collector** Run **tcpdump -n port 9992 **on NetSense netflow collector machine to check if you are receiving netflow data from your network device. Sample illustration below ![image](media://b91cfc4e-205a-49ca-b780-84bc6f1f580f) **Fine tuning netflow export on Netflow devices** The netflow data export timers configuration on the network devices like routers, switches or firewalls determine the frequency of netflow data export and also in turn the flow volume generated on your respective network device. Reducing the export timers will lead to significant overhead on your network devices but also create huge flow data volume exported causing wastage of network bandwidth and also huge processing overhead on NetSense netflow collector. A sample example for Cisco switch is provided below and this can vary across different vendors and types of devices. Refer to your respective network device netflow configuration guides for more information the recommended timers are as below **Inactive Timeout : 15 seconds** **Active Timeout : 300 seconds** Reducing these timers to lower values can substantially increase flow volume and cause overhead on your network device ![image](media://50c287b1-9f6a-45f1-8f0e-f95b7b94ae4e)