Network Device Configuration Guidev7.0.20
Netmon can only analyze the traffic your network gear sends it. This guide shows how to configure the switches, routers, and firewalls you already own to feed Netmon two ways — mirrored packets (SPAN) and flow records (NetFlow, IPFIX, sFlow) — with exact CLI steps for fourteen vendor platforms.
Netmon sees your network two ways.
- Mirrored traffic (SPAN / port mirroring). A switch copies the packets crossing its production ports and sends that copy to the port your Netmon appliance’s monitoring interface is cabled to. Netmon inspects the mirrored stream continuously — the packet analyzer, topology map, traffic reports, intrusion-detection events, and packet capture all draw from it.
- Flow records (NetFlow / IPFIX / sFlow). A switch, router, or firewall summarizes conversations it forwards and exports those summaries to Netmon’s flow collector over UDP. Flow export extends Netmon’s reach to segments it cannot watch directly, without any cabling to a mirror port.
The two are complementary: mirroring gives full packet visibility on the links you can cable to the appliance; flow export gives conversation-level visibility everywhere your gear forwards traffic. Many sites use both.
How this guide is organized
Each vendor page covers one platform family and contains, where the platform supports it, a Mirror traffic (SPAN) section and an Export flow data section. Use the page for your hardware, follow the device-side steps, then complete the matching Netmon-side step in Receiving the Data in Netmon — the Netmon side is the same regardless of which switch sent the traffic.
Replace the placeholders as you go: <netmon-ip> is your appliance’s address, and interface names (<slot/port>, ge-0/0/0, Ethernet1, and so on) are whatever your device calls the ports in question.
Everything here is sourced
Every command, protocol version, and port number in this guide is taken from the vendor’s own documentation. Each section ends with a Source line naming the exact document, with its URL and the software release it documents.
Network vendors revise CLI syntax, feature names, and hardware support across software releases and product lines. The commands here are correct for the release cited in each section, but a different model or firmware on your bench may differ. When in doubt, open the cited document for your platform and release before you commit a change.
A note on flow protocols and ports
Netmon’s collector accepts NetFlow (v1, v5, v7, v9), IPFIX (also called NetFlow v10), and sFlow. By default it listens for NetFlow and IPFIX on UDP 9996 and for sFlow on UDP 6343. Several vendors default their exporters to a different port (2055, 9995, 4739, and others are common), so most flow sections include a step that points the exporter explicitly at the Netmon ports above. Both listener ports are adjustable on the Netmon side if you would rather match the device — see Receiving the Data in Netmon.
Choose your platform
Find your hardware below and follow its device-side steps. Each page is self-contained, with its own SPAN and flow-export sections and vendor citations.
The Netmon side
Whichever vendor you configured, the last step is on the appliance: point a monitoring NIC at the mirror feed, or enable flow collection on the device’s entry in Netmon. Both procedures live on one page, the same for every vendor.