Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Flow Sources

SUMMARY When you install an Network Insights host, two types of flow sources are required. A Network Insights host processes raw traffic from a network interface flow source and then exports these flow records to an IPFIX flow source running elsewhere in your JSA deployment.

On Network Insights hosts, an input flow source is automatically created for all non-management interfaces that are available on the host. Except for Napatech interfaces, these flow sources are disabled by default, so you must enable the flow source if you want to use it for monitoring network flows.

In the following example, a Network Insights host (qnihw1) is connected to a JSA Console (qradarhw1). The system does not create a flow source for the management interface of the appliance (ens2f0).
For appliances that use a Napatech network interface, the auto-detected flow source is enabled by default, and cannot be edited, disabled, or deleted. The flow source appears as napatech0.

Configure an IPFIX flow source for Network Insights to export its flows to. By default, default_NetFlow sources are automatically created for JSA Console, Flow Processor, and Flow Collector hosts. For more information on these flow sources, see Flow Sources.