This cartridge pack is for NetFlow collection and processing:

• The NetFlow Collection Cartridge (CC) collects the Cisco NetFlow v1, v5, and v7 records.

• The NetFlow Session Aggregation Processor (AP) aggregates Cisco NetFlow (V1, V5, and V7) records which have the following attributes:

  • Source IP addresses

  • Destination IP addresses

  • Source port number

  • Destination port number

  • IP protocol type

  • Day of year and hour

  Each aggregated NetFlow session record contains the above information as well as total bytes, and total packets.

The NetFlow Collection and Processing cartridge pack will aggregate, into a single record on an hourly basis, NetFlow records belonging to the same NetFlow session. The aggregated records will be output by the AP after the user-configured flush timer has expired.

Figure 7-1 displays the architecture of the solution.

The NetFlow Collection Cartridge (CC) collects the Cisco NetFlow v1, v5, and v7 records.

Table 7-1 shows the options to configure in the NetFlow tab.