Netmon Docs

Network Device Configuration Guidev7.0.20

Netmon can only analyze the traffic your network gear sends it. This guide shows how to configure the switches, routers, and firewalls you already own to feed Netmon two ways — mirrored packets (SPAN) and flow records (NetFlow, IPFIX, sFlow) — with exact CLI steps for fourteen vendor platforms.

Netmon sees your network two ways.

The two are complementary: mirroring gives full packet visibility on the links you can cable to the appliance; flow export gives conversation-level visibility everywhere your gear forwards traffic. Many sites use both.

How this guide is organized

Each vendor page covers one platform family and contains, where the platform supports it, a Mirror traffic (SPAN) section and an Export flow data section. Use the page for your hardware, follow the device-side steps, then complete the matching Netmon-side step in Receiving the Data in Netmon — the Netmon side is the same regardless of which switch sent the traffic.

Replace the placeholders as you go: <netmon-ip> is your appliance’s address, and interface names (<slot/port>, ge-0/0/0, Ethernet1, and so on) are whatever your device calls the ports in question.

Everything here is sourced

Every command, protocol version, and port number in this guide is taken from the vendor’s own documentation. Each section ends with a Source line naming the exact document, with its URL and the software release it documents.

Verify against your exact model and release

Network vendors revise CLI syntax, feature names, and hardware support across software releases and product lines. The commands here are correct for the release cited in each section, but a different model or firmware on your bench may differ. When in doubt, open the cited document for your platform and release before you commit a change.

A note on flow protocols and ports

Netmon’s collector accepts NetFlow (v1, v5, v7, v9), IPFIX (also called NetFlow v10), and sFlow. By default it listens for NetFlow and IPFIX on UDP 9996 and for sFlow on UDP 6343. Several vendors default their exporters to a different port (2055, 9995, 4739, and others are common), so most flow sections include a step that points the exporter explicitly at the Netmon ports above. Both listener ports are adjustable on the Netmon side if you would rather match the device — see Receiving the Data in Netmon.

Choose your platform

Find your hardware below and follow its device-side steps. Each page is self-contained, with its own SPAN and flow-export sections and vendor citations.

Cisco IOS & IOS-XECatalyst switches and ISR/ASR routers on classic IOS or IOS-XE — Local SPAN plus Flexible and Traditional NetFlow. Cisco Nexus (NX-OS)Nexus 9000 data-center switches on NX-OS 10.3 — local SPAN, NetFlow v9, and sFlow. Juniper Junos OSEX/QFX switches and MX routers / SRX firewalls — analyzer port mirroring and inline active flow monitoring (J-Flow). Arista EOSArista switches on EOS — local SPAN, plus sFlow or IPFIX (never classic NetFlow). HPE Aruba ArubaOS-CXAOS-CX 10.x switches (6300/6400/8100/8325/8360) — local mirroring and IPFIX export. HPE Aruba ArubaOS-Switch (ProVision)AOS-S ProVision switches (2530/2540/2930F/2930M) — port mirroring and sFlow v5. Dell PowerSwitch OS10Dell PowerSwitch and PowerEdge MX modules on SmartFabric OS10 — local monitor sessions and sFlow only. Extreme EXOS / Switch EngineExtremeXOS / Switch Engine switches — named mirror instances and sFlow export. Fortinet FortiGate (FortiOS)FortiGate firewalls on FortiOS — software-switch mirroring, NetFlow/IPFIX, and sFlow. Fortinet FortiSwitchStandalone FortiSwitch units on FortiSwitchOS — SPAN mirroring and sFlow v5. MikroTik RouterOSMikroTik routers and switches on RouterOS v6/v7 — switch-chip mirroring and Traffic Flow (NetFlow/IPFIX). Huawei VRPHuawei S-series switches and AR routers on VRP — port mirroring plus NetStream (NetFlow) or sFlow. Palo Alto PAN-OSPalo Alto firewalls on PAN-OS 11.1 — NetFlow v9 export, with mirroring done upstream of the firewall. Ubiquiti UniFi / EdgeRouter / EdgeSwitchUniFi and EdgeMAX gear — port mirroring across the line, NetFlow/IPFIX from gateways and EdgeRouters.

The Netmon side

Whichever vendor you configured, the last step is on the appliance: point a monitoring NIC at the mirror feed, or enable flow collection on the device’s entry in Netmon. Both procedures live on one page, the same for every vendor.