Netmon Docs · Device Configuration Guide

Arista EOSv7.0.20

Set up local SPAN mirroring and sFlow or IPFIX export on Arista EOS switches so Netmon can see the traffic crossing them.

This page covers Arista switches running EOS (verified against EOS 4.36.0F): local port mirroring (SPAN) and flow export. Note that EOS emits sFlow or IPFIX, never classic NetFlow — pick whichever your platform supports.

Mirror traffic (SPAN)

EOS local port mirroring (a monitor session) copies traffic from one or more source interfaces to a destination interface cabled to a Netmon sniffer NIC. By default a mirror session duplicates both ingress and egress traffic; you can restrict it to one direction with the rx (ingress only) or tx (egress only) keyword.

Define the monitor session source. The session name (redirect_1 here) is any label you choose; the source is the interface you want to observe.
```
switch(config)# monitor session redirect_1 source ethernet 7
```
(Optional) Mirror only one direction by adding rx or tx to the source line instead of the default both-directions behavior. (The vendor example shown also applies an ACL filter; the direction keyword works without one.)
```
switch(config)# monitor session 1 source Ethernet1 rx ip access-group acl1
```
Set the destination interface — the port physically cabled to the Netmon sniffer NIC. Use a separate, unused interface.
```
switch(config)# monitor session redirect_1 destination ethernet 8
```
Verify the session.
```
switch(config)# show monitor session
```

Note

On platforms that support GRE-encapsulated remote mirroring, EOS can tunnel mirrored traffic to a remote IP. This delivers the packets to a routed destination rather than a directly cabled port, so it is only useful if your Netmon sniffer NIC terminates that tunnel — prefer the local destination-interface form above for a directly attached appliance.

switch(config)# monitor session abc source Ethernet1 rx ip access-group acl1
switch(config)# monitor session abc destination tunnel mode gre source 1.1.1.1 destination 2.2.2.2 ttl 128 dscp 0 protocol 0x88be

Important

The destination interface should be dedicated to mirroring. On the Netmon side, set the receiving NIC to Sniffer (manual) so it captures continuously — see Receiving the Data in Netmon.

Source: Arista EOS 4.36.0F User Manual — Data Transfer. https://www.arista.com/en/um-eos/eos-data-transfer

Export flow data

Arista EOS does not produce classic NetFlow. It exports sFlow (UDP 6343 by default) or IPFIX via Sampled Flow Tracking (UDP 4739 by default). sFlow’s default port is an exact match for Netmon’s sFlow collector, so it is the lowest-friction option and the recommended choice. IPFIX is platform/ASIC-gated — use it only if your hardware supports Sampled Flow Tracking.

Option A — sFlow (recommended)

Point sFlow at the Netmon appliance. The default UDP port is 6343, which matches Netmon’s sFlow collector, so no port override is needed.
```
switch(config)# sflow destination <netmon-ip>
```
Set the exporter source address so packets arrive from the address Netmon already knows this device by.
```
switch(config)# sflow source <source_addr>
```
Or pin it to an interface (for example a loopback or VLAN SVI):
```
switch(config)# sflow source-interface loopback 0
```

(Optional) Tune the sampling rate and counter polling interval.

switch(config)# sflow sample 65536
switch(config)# sflow polling-interval 10

Enable sFlow on each interface you want sampled.

switch(config)# interface ethernet <number>
switch(config-if-Et#)# sflow enable

Enable sFlow globally.
```
switch(config)# sflow run
```

Option B — IPFIX via Sampled Flow Tracking

Important

Sampled Flow Tracking / IPFIX is platform- and ASIC-dependent and is not available on every Arista model. The IPFIX default collector port is 4739, which does not match Netmon — you must override it to 9996 as shown below.

Enter Sampled Flow Tracking and create a tracker.

switch(config)# flow tracking sampled
switch(config-flow-tracking-sampled)# tracker ftr1

Define an exporter under the tracker.

switch(config-ftr-sampled-tr-ftr1)# exporter exp1

Point the collector at Netmon and override the default 4739 to Netmon’s IPFIX port 9996.
```
switch(config-ftr-sampled-tr-ftr1-exp-exp1)# collector <netmon-ip> port 9996
```
Set the local source interface so exported packets arrive from the address Netmon knows this device by.
```
switch(config-ftr-sampled-tr-ftr1-exp-exp1)# local interface Ethernet1
```

Activate the exporter.

switch(config-ftr-sampled-tr-ftr1-exp-exp1)# no shutdown

Set the sample rate.

switch(config-flow-tracking-sampled)# sample 1024

Enable the tracker on each interface you want flow-tracked.

switch(config)# interface Ethernet2
switch(config-if-Et2)# flow tracker sampled ftr1

Note

Whichever option you choose, the Netmon-side step — enabling Allow Netflow Data Collection on the device — is documented once in Receiving the Data in Netmon.

Source: Arista EOS 4.36.0F User Manual — sFlow. https://www.arista.com/en/um-eos/eos-sflow

Source: Arista EOS 4.36.0F User Manual — Sampled Flow Tracking. https://www.arista.com/en/um-eos/eos-sampled-flow-tracking

PreviousJuniper Junos OS NextHPE Aruba ArubaOS-CX