NetFlow Data Processing
You can use Data Collector to process NetFlow 5 and NetFlow 9 data.
When processing NetFlow 5 data, Data Collector processes flow records based on information in the packet header. Data Collector expects multiple packets with header and flow records sent on the same connection, with no bytes in between. As a result, when processing NetFlow 5 messages, you have no data-related properties to configure.
When processing template-based NetFlow 9 messages, Data Collector
generates records based on cached templates, information in the packet header, and
NetFlow 9 configuration properties in the stage. The NetFlow 9 properties display in
different locations depending on the type of stage that you use:
- For origins that process messages directly from the network, such as the UDP Source origin, you configure the NetFlow 9 properties on a NetFlow 9 tab.
- For most origins and processors that process other types of data, such as JSON or protobuf, you configure NetFlow 9 properties on a Data Formats tab after you select Datagram or NetFlow as the data format.
- For the TCP Server, you specify the NetFlow TCP mode, and then configure NetFlow 9 properties on a NetFlow 9 tab.
When processing NetFlow 5 messages, the stage ignores any configured NetFlow 9 properties.