NetFlow data from a physical device observed via "tcpdump" at the collector but flows are not reported in VCF Operations for Networks

Products

• VCF Operations for Networks

Issue/Introduction

If NetFlow data from a physical device is observed via "tcpdump" at the collector, but flows are not reported in VCF Operations for Networks, it may be that the device is configured to send data via the SFlow protocol instead of the Netflow protocol.  

 

 

 

NOTE:  VCF Operations for Networks was formerly named Aria Operations for Networks (AON), and prior to that was named vRealize Network Insight (vRNI).

 

Environment

VCF Operations for Networks 6.x

 

Cause

Physical devices can often be configured to send flow data using either Netflow protocol, or SFlow protocol.  

Netflow protocol uses port 2055 and Sflow uses port 6343, per reference at VMware Ports and Protocols

If data is being observed to be arriving at a VCF Operations for Networks collector using "tcpdump" and the Netflow protocol (port 2055) from at least one device, but flows are not being observed from a physical device, the physical device for which flows are not being observed may be configured to send data using SFlow rather than Netflow.  

 

 

Resolution

Per Add a Physical Flow Collector for NetFlow and sFlow

• You can add a physical flow collector and configure the switches to send sFlow and NetFlow records to the collector.
• The collector VM that is used for NetFlow or sFlow is a dedicated collector. It cannot be used for any other data source.