Skip to main content
Version: 2.10.1

NetFlow Recorder

This page enables you to look back in time for security issues. You can set rolling *flow capture and replay period of time, and store *flows in memory or on disk.

note

Please enable throttling if NFO output is configured to send data out over UDP network. Without throttling NFO will send all recorded *flows instantly, which may result in losses. Add the following lines to /server/etc/server.cfg

THROTTLE_OUTPUT 1
THROTTLE_OUTPUT_RATE 1000

Throttling output rate is the number of syslogs/JSON messages to be sent out every second.

Play, Start recording, Stop recording buttons

Play, Start recording, Stop recording buttons.

Press to start capturing flow records. Press button to send recorded flow records in syslog or JSON format to your SIEM to gain complete visibility of past network traffic. Press to stop recording.

The service has the following parameters:

ParameterDescription
Rolling Time IntervalRolling time period for continues recording of flow records. You can specify a time unit after a time value 'X', such as Xd, Xh, Xm, or Xs to represent days (d), hours (h), minutes (m), and seconds(s) respectively. (e.g. 10d 8h 30m 30s). Default 10 minutes
Record in memory or disk (0 - Memory, 1 - Disk)You have an option to keep recorded flow records in memory or on disk
Path to disk directoryIf you selected disk option above, set the path to directory where flow records will be recorded. Default is ../../logs/replay
Disk recorder buffer size, bytesThe size of the memory buffer block for flow records to be accumulated before written to disk. Default is 4MB (4194304 bytes)
Disk recorder threadsThe number of processor threads reserved for writing data to disk. Default is 2
Disk recorder queue, recordsSize of the buffer to hold records in queue in case of peaks in incoming flow records. Default is 10,000
Disk file chunk size, messagesFile rotation size in number of messages. Default is 10,000 (*)
Disk file rotation period, msecFile rotation time interval in msec. Default is 1 sec (*)
Exporter IPs to record watchlistIf you want to limit capture and replay to a number of NetFlow exporters, you can specify their IP addresses here

(*) The file is closed when the specified number records (chunk size) is written or file rotation time elapses, whichever comes first.