Top VM:Host Pairs (10164 / 20164)
Description
This Module reports top network conversations in VM environment. A network conversion is a series of data exchanges between two VM:Hosts (VM source IP:Host source IP and VM destination IP:Host destination IP), over the same protocol (TCP or UDP), and going through the same vSphere Distributed switch (VDS) (VxLAN ID). The number of exchanged bytes and packets are summed up.
The Module determines which VM:Host is a client and which is a server as follows: a server sends more traffic (bytes) than a client.
Parameters
| Parameter Name | Description | Comments |
|---|---|---|
| Data Collection Interval, sec | Module logic execution interval | min = 5 sec, max = 600 sec, default = 30 sec |
| N - number of reported host:vm pairs | The number of top hosts reported per NetFlow exporter | min = 0, max = 100000, default = 50 (0 indicates all hosts are reported) |
Input
VMware IPv4 VXLAN Template.
Syslog/JSON Message Fields
| Key | Field Description | Comments |
|---|---|---|
| nfc_id | Message type identifier | "nfc_id=200164" |
| exp_ip | NetFlow exporter IP address | <IPv4_address> |
| vxlanId | VxLAN ID | <number> |
| sourceIPv4Address | Source host IPv4 address | <IPv4_address> |
| destinationIPv4Address | Destination host IPv4 address | <IPv4_address> |
| packetDeltaCount_in | Packets from client to server | <number> |
| octetDeltaCount_in | Layer 3 bytes from client to server | <number> |
| packetDeltaCount_out | Packets from server to client | <number> |
| octetDeltaCount_out | Layer 3 bytes from server to client | <number> |
| packetDeltaCount | Total Packets in the flow received by the input interface | <number> |
| octetDeltaCount | Total number of Layer 3 bytes in the packets of the flow received by the input interface | <number> |
| tenantSourceIPv4 | Source VM IPv4 address | <IPv4_address> |
| tenantDestIPv4 | Destination VM IPv4 address | <IPv4_address> |
| vm_adjacency | VM adjacency indicator. If equal “Y”, VMs are residing on the same host. | <string> “Y” or “N” |
| flow_count | Number of Flows | <number> |
| percent_of_total | Percent of Total (bytes) VXLAN traffic | <decimal> |
| t_int | Observation time interval, msec | <number> |