NetFlow Recorder

This page enables you to look back in time for security issues. You can set rolling *flow capture and replay period of time, and store *flows in memory or on disk.

note

Please enable throttling if NFO output is configured to send data out over UDP network. Without throttling NFO will send all recorded *flows instantly, which may result in losses. Add the following lines to /server/etc/server.cfg

THROTTLE_OUTPUT 1
THROTTLE_OUTPUT_RATE 1000

Throttling output rate is the number of syslogs/JSON messages to be sent out every second.

Play, Start recording, Stop recording buttons

Press to start capturing flow records. Press button to send recorded flow records in syslog or JSON format to your SIEM to gain complete visibility of past network traffic. Press to stop recording.

The service has the following parameters:

Parameter	Description
Rolling Time Interval	Rolling time period for continues recording of flow records. You can specify a time unit after a time value 'X', such as Xd, Xh, Xm, or Xs to represent days (d), hours (h), minutes (m), and seconds(s) respectively. (e.g. 10d 8h 30m 30s). Default 10 minutes
Record in memory or disk (0 - Memory, 1 - Disk)	You have an option to keep recorded flow records in memory or on disk
Path to disk directory	If you selected disk option above, set the path to directory where flow records will be recorded. Default is ../../logs/replay
Disk recorder buffer size, bytes	The size of the memory buffer block for flow records to be accumulated before written to disk. Default is 4MB (4194304 bytes)
Disk recorder threads	The number of processor threads reserved for writing data to disk. Default is 2
Disk recorder queue, records	Size of the buffer to hold records in queue in case of peaks in incoming flow records. Default is 10,000
Disk file chunk size, messages	File rotation size in number of messages. Default is 10,000 (*)
Disk file rotation period, msec	File rotation time interval in msec. Default is 1 sec (*)
Exporter IPs to record watchlist	If you want to limit capture and replay to a number of NetFlow exporters, you can specify their IP addresses here

(*) The file is closed when the specified number records (chunk size) is written or file rotation time elapses, whichever comes first.