Capturing NetFlow data from local traffic

You can use the Flow Publisher to capture NetFlow data from a local interface by installing the publisher on the server from which you want to collect NetFlow data, configuring the local interface as the capture device and setting the capture mode to Normal. The Flow Publisher will automatically map the local network interface card MAC address as the reference interface.

When you capture traffic on a Virtual Machine (VM), you must consider the capture mode setting based on the traffic from which you want to collect NetFlow data. If you select Normal mode, only the traffic that is addressed to or from the physical machine will be captured. If you select Promiscious mode, all of the traffic addressed to or from the virtual machines will be captured as well, allowing you to collect NetFlow statistics on the individual virtual machines as well as the physical server.

You can also collect NetFlow statistics on a virtual server by installing NetFlow on the virtual server and configuring the capture mode of the virtual interface to Normal. This configuration will provide NetFlow statistics on all of the traffic to or from the virtual server.