Collect traffic from NetFlow and sFlow devices

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Network Settings section, click Connectivity.
3. In the Interfaces section, click the name of the interface that should receive the flow data.
4. Select Management + Flow Target in the Interface Mode drop-down list.

   Note:

   The EDA 1100, EDA 1100v, and EDA 1000v must be configured for either flow data or wire data because these models cannot process flow data and wire data simultaneously. If these models are configured for flow data, you must set the monitoring port to Disabled.

5. If Enable DHCPv4 is selected, click Save. Otherwise, configure the remaining network settings and then click Save.

1. In the Network Settings section, click Flow Networks.
2. In the Ports section, type the UDP port number in the Port field. The default port for Net Flow is 2055 and the default port for sFlow is 6343. You can add additional ports as needed for your environment.
3. From the Flow Type drop-down menu, select NetFlow or sFlow. For AppFlow traffic, select NetFlow.
4. Click the plus icon (+) to add the port.
5. Save the running configuration file to preserve your changes by clicking View and Save Changes at the top of the Flow Networks page, and then click Save.

1. In the Network Settings section, click Flow Networks
2. In the Pending Flow Networks section click Add Flow Network.
3. Type a name to identify this flow network in the Flow Network ID field.
4. Select the Automatic records checkbox to send records from this flow network to a connected recordstore.
5. Select the Enable SNMP polling checkbox to enable SNMP polling.
6. If you enable SNMP polling, select one of the following options from the SNMP credentials drop-down menu:
   • Inherit from CIDR. If you select this option, the SNMP credentials are applied based on the Shared SNMP Credentials settings.
   • Custom credentials. Select v1, v2, or v3 from the SNMP version drop-down list and then configure the remaining settings for the specific polling type.
7. Click Save.
   The flow network appears in the Approved Flow Networks table. If you do not see the flow network, you can manually add it by clicking Add Flow Network in the Approved Flow Networks section and completing the information as described above.

After you configure your flow networks, log in to the ExtraHop system to view built-in charts and modify settings and configurations.

1. Log in to the ExtraHop system through https://<extrahop-hostname-or-IP-address>.
2. Click Assets and then click Networks.
3. Click the drop-down arrow next to the flow network name to see a list of flow interfaces and their attributes.
4. Select the checkbox next to the flow network or interface name. From the top bar, you can create a chart, assign a trigger, assign an alert, rename the flow interface, and set the interface speed.

   Note:

   Each NetFlow record contains the interface index (ifIndex) of the reporting interface. The interface table (ifTable) is then polled by the ExtraHop system to obtain the interface speed (ifSpeed).

5. Click the flow network name or flow interface name to view built-in charts on summary pages. From the summary pages, you can click the regions and charts and add them to a new or existing dashboard.