NetFlow Question

2 views

Skip to first unread message

Michael Herr

unread,

Jan 18, 2016, 4:04:14 PM1/18/16

to xcnd

If you are collecting Netflow from an internal switch, but the connection is being denied at the border firewall, will the Netflow still log the event?

Thanks,

Mike

Jake Ross

unread,

Jan 18, 2016, 4:07:19 PM1/18/16

to Michael Herr, xcnd

Ya but the local cache is like 200 sessions. It gets over written pretty fast. Let me find the reference.

--
You received this message because you are subscribed to the Google Groups "xCND" group.
To unsubscribe from this group and stop receiving emails from it, send an email to xcnd+uns...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Michael Herr

unread,

Jan 18, 2016, 4:28:45 PM1/18/16

to Jake Ross, xcnd

Thanks. It is being sent to the SIEM, but we are not seeing the connection. It may be due to the location they are collecting NetFlow from.