13.6. Using Packets and Netflow together
Trisul can also consume a mix of Netflow and raw packets on the same or on different interfaces. The way this feature works is :
- Packets on Netflow ports will be expanded and interpreted as Netflow/JFlow/IPFix/etc
- Other packets will be treated as usual
If you want to only consume Netflow then refer to the Netflow Setup Howto
13.6.1 How to use this mode
To use this mixed mode – we use a different technique than that described in the Netflow only setup
We now enable netflow on a per-adapter mode.
For instance if you have the following scenario
- Netflow traffic on
PCAP traffic on
and you wish to pull them into a single instance of Trisul you would do the following.
- Go to Customize > Network Adapters
- Create an adapter for eth0
- Create an adapter for eth1
- For eth1 – check the Force Netflow Mode checkbox
- For eth0 – ensure the Force Netflow Mode checkbox is unchecked
- Enable both eth0 and eth1 adapters
- Restart Trisul
Netflow and PCAP on the same interface
If you have Netflow and PCAP on the same interface (say eth0). You would create two eth0 interfaces and check the “Force Netflow Mode” on only one of them.