Receiving the Data in Netmonv7.0.20
You have configured a switch, router, or firewall to send Netmon its traffic. These are the two short procedures on the Netmon side that turn that feed into live data — the same steps no matter which vendor sent it.
The device-side configuration in each vendor page only sends traffic toward the appliance. These two procedures are the matching Netmon side. Do the one that corresponds to what you configured on the device.
Receiving mirrored traffic (SPAN)
Once the switch is mirroring production traffic to the port your appliance’s monitoring interface is cabled to, tell Netmon which of its interfaces is receiving it:
- Open System → System Settings → Network Interfaces.
- Expand the interface cabled to the SPAN/mirror destination port.
- Set Configure As to Sniffer (manual) and press Submit. Applying the change may take a minute.
From that moment Netmon’s continuous inspection engine is reading the mirrored stream: the packet analyzer, topology map, traffic reports, intrusion-detection events, and packet capture all gain whatever the mirror session can see.
A mirror/SPAN destination port carries the sum of its sources’ traffic. If you mirror several busy gigabit links into one gigabit destination, the switch drops the overflow silently — size the destination (or narrow the sources) accordingly.
Receiving flow data (NetFlow / IPFIX / sFlow)
Netmon’s flow collector listens on UDP 9996 for NetFlow and IPFIX and on UDP 6343 for sFlow. A device must be known to Netmon, and flow collection enabled on it, before its exported records are accepted and stored:
- Open the device’s page under Device Dashboard and slide out the Settings pane (the gear tab at the right edge).
- Enable Allow Netflow Data Collection.
- Under Trackers → Interfaces, confirm the interfaces sending flow data have logging enabled.
Flow data then appears in the device’s traffic views, the Logs and Events NetFlow stream, the topology map, and the traffic reports.
Each vendor page points the device’s exporter at UDP 9996 (NetFlow/IPFIX) or UDP 6343 (sFlow) so it matches the listeners above. If you instead need Netmon to listen where a device already exports, the two listener ports are adjustable in the flow collector’s settings; change one side or the other, but make them agree.
Netmon associates incoming flow with the device whose address matches the packet’s source IP. On devices that let you choose the exporter’s source interface/address (most routers and L3 switches), set it to the address Netmon knows the device by — each vendor page notes where. Records arriving from an unrecognized source address are not stored.