NFA: What are the supported SFlow Sample Types?

Products

• Network Flow Analysis

Issue/Introduction

What are the supported SFlow Sample Types in NFA?

Resolution

The following Sample Types are Supported:

FORMAT 1 - Flow Samples:  Supported in RA.8.3.16 and newer
FORMAT 3 - Expanded Flow Samples:  supported in RA 9.0 update 1 (9.0.161)

The following Sample Types are Not Supported and the flows will be discarded from NFA

FORMAT 2 - Counter Samples:  Unsupported
FORMAT 4 - Expanded Counter Samples:  Unsupported

 

Additional Information:

The Sample Type can be found by looking at the pcap of the device in Wireshark, and going to "Analyze->Decode As" and decoding it as "SFLOW".

You can hit "Ctrl + F" and then select "By:String" and "Search in: Packet Details" and search for "sample".