Pages

Sunday, December 1, 2013

Playing around with Netflow on the vSphere Distributed Switch.

I'll start of this post by saying that I am not a Netflow expert, so I have a pretty steep learning curve here.  As with most things, I learn by finding all the available material I can, and then playing around with it to see if how it works matches my expectations.  I found very little primary documentation on Netflow in the vDS, so I had to do a lot of experimenting.

As of vSphere 5.1, the vDS supports Netflow v10, also known as IPFIX.   A flow consists of packets with the same source and destination ip addresses, ports, and protocol.  There are two flows for every connection, one in each direction. Basic information about the flow is then sent to the collector.  The collector is a third party solution that gathers the flow data and provides useful information to the network administrator.  In the vDS implementation, the information that is provided to the collector is the number of octets and packets.
(more information below the break)