Flow Sources
SUMMARY When you install an Network Insights host, two types of flow sources are required. A Network Insights host processes raw traffic from a network interface flow source and then exports
these flow records to an IPFIX flow source running elsewhere in your
JSA
deployment.
On Network Insights hosts, an input flow source is automatically created for all non-management interfaces that are available on the host. Except for Napatech interfaces, these flow sources are disabled by default, so you must enable the flow source if you want to use it for monitoring network flows.
In the following example, a Network Insights host (qnihw1) is connected to a JSA
Console
(qradarhw1). The system does not create a flow source for the
management interface of the appliance (ens2f0).
For appliances that use a Napatech network interface, the auto-detected flow source is enabled by
default, and cannot be edited, disabled, or deleted. The flow source appears as
napatech0.
Configure an IPFIX flow source for Network Insights to export its flows to. By default, default_NetFlow sources are automatically created for JSA Console, Flow Processor, and Flow Collector hosts. For more information on these flow sources, see Flow Sources.