Many networking devices like routers and switches, implement a NetFlow protocol which is used to export information of passing network traffic to a specific NetFlow collector application for analysis and visualization. Back in days, VMware ESX 3.5 had experimental support for NetFlow but it was dropped for vSphere 4, with release of vSphere 5 VMware introduced full production ready NetFlow support for vNetwork distributed switches.

NetFlow will export only information about source, destination, protocol and volume of network traffic passing the distributed switch, it will not have any visibility to actual payload.

NetFlow Analyzer

Ability to export NetFlow data doesn’t do much as-is, you need NetFlow analyzer application in which you import NetFlow data from vSphere distributed switch. While searching for application to do this I stumped on ManageEngine NetFlow Analyzer which is available as free download for 30 day evaluation, http://www.manageengine.com/products/netflow/download.html.

ManageEngine NetFlow analyzer is available as Windows and Linux versions, I downloaded Windows version and had it running in no time as installation and configuration was very easy. Once installed I glanced though NetFlow Analyzer configuration for TCP port to which I should send NetFlow data from vDS. I found this quickly under “Admin”, “Server Settings”, “NetFlow Listener Port”.

As I knew IP address of my NetFlow Analyzer server and NetFlow listener port of application I was ready to proceed with vDS configuration.

vSphere Distributed Switch Configuration

NetFlow export is configured at distributed switch level, go to the networking view in vSphere Client click “edit settings” on switch you wish to export NetFlow data from. In switch Settings you can see “NetFlow” tab and on that page you will have following settings.

First setting you should configure is “Collector IP address”, that is the IP of your NetFlow analyzer or collector application. You also need to configure correct port as every NetFlow analyzer and collector may have different default settings.

By default each ESXi host will export NetFlow data by using their own management address, because of this you will see multiple sources of traffic in your NetFlow analyzer. If you wish to have only single source for all your distributed switch traffic, you can configure specific source IP address for your vDS. This IP should be entered in “VDS IP address” field. Please note that you need to allow access from your ESXi host management IP addresses to your NetFlow analyzer/collector no matter what IP address you would type in vDS IP address.

By default distributed switch will send information about active network flow while 60 seconds have passed since flow was initiated, if you wish to have data about new flows quicker you could lower the value on “Active flow export timeout” but I do not recommend it unless you fully understand all implications it might have. I do not, so I don’t try to explain it. Data of idle network flows will be exported after 15 seconds of initial packet has passed.

Exporting NetFlow data from a vDS which is passing a LOT of traffic might have performance hit on ESXi host CPU, if you do not mind having lower resolution on your NetFlow data you could increase “Sampling rate” value. By default it is set to 0 which means that every packet is inspected and included in NetFlow export. If you set “Sampling rate” to 2 it means that every other network packet is inspected and included in NetFlow export, and so on. Increasing sampling rate will improve performance if you are having CPU utilization issues but it will also decrease NetFlow data resolution.

As last setting there is “Process internal flows only” check box. By default distributed switch will export data about all traffic passing internally on vDS or passing to or from physical network. If you have NetFlow enabled on your physical network devices it could be unnecessary to send information about flows which are passing on physical network layer also, as those are already seen and reported by other network devices. In this case you could check “Process internal flows only” setting and have distributed switch to export data only about flows which is switched directly by vDS and not passed to physical network layer, this would decrease any overhead NetFlow data exporting might have on your ESXi hosts.

Inspecting NetFlow data

Once you have your NetFlow analyzer and distributed switch properly set you should eventually have some data about network traffic taking place in your virtual infrastructure. Below is a screenshot of ManageEngine NetFlow Analyzer output about my vSphere lab traffic, you can see larger version of image by clicking of it.