1-877-248-8688
Product Learning Center
(1) Enabling of router netflow for nLive Flow or switch packet mirroring for nLive Core to provide traffic data.
(2) Installation and running of nLive (read precautions below).
(3) Setup of nLive using a web browser client.
(4) Waiting for data to accumulate for 5-10 minutes and refreshing the GUI on the browser.
Please feel free to contact technical support to get help with your installation.
Make sure that antispyware, antivirus, other security software (like Symantec) and Widows firewall are either turned off or are configured to permit various processes of nLive to run. Even if you turn off the services of these programs, they might start up again after a reboot, and interfere with nLive. (Please read user manual for Linux precautions.)
Make sure that no other web server conflicts with nLive's built in web server running on its default port set at installation time (8080 or 80 for standard HTPP, and 8443 or 443 for HTTPS).
Reboot the machine (in some cases this will fix some problems), and make sure that unwanted programs are not interfering with nLive.
Netflow is to be enabled on routers or switches to feed to nLive Flow or nLive Enterprise. Links to information on enabling netflow:
EXAMPLE: Netflow on Cisco 2600 series router.
The following are the commands to enable netflow version 5 on a Cisco 2600 series router's FastEthernet 0/0 interface. The netflow is exported to nLive running on machine 10.10.2.31. The listener UDP port on nLive is 9996.
IMPORTANT NOTE 1: Please note that netflow is enabled for IN traffic (ingress) only here. Therefore, in order to correctly receive the OUT traffic on a particular interface, netflow will need to be enabled on other interfaces where it is accounted in the IN traffic. Note that the support for OUT traffic (egress) started with IOS 12.3(11).
IMPORTANT NOTE 2: Repeat lines 4,5, and 6 (interface xxxxxx, ip route-cache flow, exit) as many times as needed to enable netflow on other interfaces.
IMPORTANT NOTE 3: Effective with Cisco IOS Releases 12.4(2)T and 12.2(18)SXD, the 'ip route-cache flow' command is replaced by the 'ip flow ingress' command.
router>enable
Password:******
router#configure terminal
router(config)#interface FastEthernet 0/0 (repeat from here for each interface)
router(config-if)#ip route-cache flow
router(config-if)#exit (repeat till here for each interface)
router(config)#ip flow-export destination 10.10.2.31 9996 (nLive server IP and port 9996)
router(config)#ip flow-export source FastEthernet 0/0 (interface closest to nLive)
router(config)#ip flow-export version 5
router(config)#ip flow-cache timeout active 1
router(config)#ip flow-cache timeout inactive 15
router(config)#snmp-server ifindex persist
router(config)#^Z
router#write
To view these settings:
router#show ip flow export
router#show ip cache flow
Packets are to be mirrored on switches to feed to nLive Core or nLive Enterprise. Links to information on enabling packet mirroring / SPAN / RSPAN:
EXAMPLE: Configuring SPAN
We want to mirror all traffic going to and from the first 23 Ethernet ports on a 24-port switch. Then we want to send copies of all that traffic to port 24 which is where nLive Core or Enterprise is sniffing the packets. The commands to enable the SPAN are:
Switch# configure terminal
Switch(config)# monitor session 1 source interface FastEthernet 0/1 - 23 both
Switch(config)# monitor session 1 destination interface FastEthernet0/24
The keyword 'both' indicate that we are mirroring both ingress and egress packets.
Command to check the status of the the SPAN session is:
Switch# show monitor
Command to disable the SPAN session is:
Switch(config)# no monitor session 1