Managing the NetFlow Dashboard
NetFlow Optimization
Arista Analytics may consolidate NetFlow records to improve performance.
The Analytics server/cluster consolidates flows received within two seconds into a single flow when the source and destination IP addresses are the same or the source or destination L4 protocol port is the same.
For example, ten flows received by the Analytics server within thirty second period are consolidated into a single flow if the source and destination IP addresses and destination port are the same for all the flows and only the source ports are different or if the source and destination IP addresses and source port are the same for all the flows and only the destination ports are different. This consolidated flow displays as a single row.
By default, the NetFlow Optimization is enabled for Netflow v5 and disabled for Netflow v9 and IPFIX. To allow the Netflow Optimization for Netflow v9 and IPFIX, refer to Consolidating Netflow V9/IPFIX records section.
This consolidation improves Analytics NetFlow performance, allowing more efficient indexing and searching of NetFlow information.
Viewing Filter Interface Information on the NetFlow Dashboard
Add the filter interface name to the NetFlow dashboard to see hop-by-hop forwarding of flows for NetFlow traffic coming from the DMF Service Node for a specific flow. Arista Analytics then shows the filter interface name associated with that flow. If the flow goes through two hops, then two filter interface names are displayed for the flow.
Displaying Filter Interface Names
controller(config)# managed-service netflow-managed-service
controller(config-managed-srv)# service-action netflow netflow-delivery-int
controller(config-managed-srv-netflow)# collector 10.8.39.101 udp-port 2055 mtu 1500 records-per-interface
NetFlow Managed Service Records-per-interface Option
! managed-service
managed-service netflow-managed-service
service-interface switch 00:00:4c:76:25:f5:4b:80 ethernet4/3:4
!
service-action netflow netflow-delivery-int
collector 10.8.39.101 udp-port 2055 mtu 1500 records-per-interface
controller(config)# sh running-config bigtap policy netflow-policy
! policy
policy netflow-policy
action forward
filter-interface filter-int-eth5
use-managed-service netflow-managed-service sequence 1 use-service-delivery
1 match any
After enabling this option, the nFlow by Filter Interface window, shown above, displays the filter interface identified in the policy that uses the NetFlow managed service.
The production device port connected to the filter interface sends LLDP messages, Arista Analytics also displays the production switch name and the production interface name attached to the filter interface in the nFlow by Production Switch & IF window.
NetFlow Traffic Coming from Third-party Devices
Arista Analytics can act as a NetFlow collector for third-party devices. In this case, Arista Analytics displays third-party device management IP addresses and the interface index (iFindex) of the interface for each NetFlow-enabled third-party device.
For example, the nFlow by Production Device & IF window shows that 10.8.39.198 is the third-party device that forwards NetFlow traffic. The iFindex of the interface on that device where NetFlow is enabled is 0, 2, 3, 4.
Arista Analytics then performs SNMP polling and displays the third-party device name and the actual interface name in the nflow by Production Device & IF window.
To perform the SNMP configuration, complete the following steps:
Displaying Flows with Out-Discards
The NetFlow dashboard allows displaying flows with out-discards when the NetFlow packets come from third-party devices. To display this information, use the flows via interfaces with SNMP out-discards tab at the top of the Arista Analytics NetFlow dashboard.
To display the flows with out-discards, click the flows via interfaces with SNMP out-discards tab and click the Re-enable button. This window displays the flows with out-discards.