1.3. Getting started

Please follow these steps to start monitoring your network traffic with sFlowTrend-Pro. It will also be useful to have the documentation available for your network switches.

  1. Ensure that you have some switches or hosts that support sFlow. sFlowTrend-Pro can only monitor switches or hosts using sFlow.

  2. The sFlowTrend-Pro service should be started automatically after each reboot. To connect to the service to use the product, point a web browser at http://[hostname]:8087/sflowtrend (or over https https://[hostname]:8443/sflowtrend).

  3. Configure the license to allow sFlow to be collected. Refer to Section, “Configuring the license” for information on how to set the license.

  4. Select System configuration menu item and then select the sFlow tab. Note the sFlow collector address and UDP port that sFlowTrend-Pro is using to receive sFlow. If your host has multiple IP addresses, they will be accessible through the sFlow collector address selector. Select the most appropriate IP address for sFlowTrend-Pro to use to receive sFlow.

  5. Make sure that any host based firewalls, or external firewalls between the host running sFlowTrend-Pro and the switches being monitored allow:

    • UDP traffic from the switches being monitored to the sFlow port on the host running sFlowTrend-Pro.
    • UDP traffic to and from the host running sFlowTrend-Pro to the SNMP port (port 161) on the switches being monitored.

  6. If you are connecting to a remote sFlowTrend-Pro server, make sure that any host or external firewalls will allow communication between the client and the server. The client uses TCP port 8087 by default to connect to the server.
  7. Select System configuration menu item and then select the SNMP tab. Choose whether sFlowTrend-Pro should use SNMP v2c or SNMP v3 by default when communicating with the switches, and enter the appropriate settings for your network. In addition to these global settings, the SNMP settings can also be overridden per switch (see Section 13.3, “Configuring agents in sFlowTrend-Pro ). Note that the SNMP settings must allow write access if your switches are to be configured using SNMP (see below). If the switches are configured manually, then settings that allow read access can be used.

  8. Next, sFlow should be enabled on the switches you wish to monitor. How this is done depends on the make and model of each switch. Some switches support sFlow configuration through SNMP, while others require that it is manually configured through the configuration interface for the switch (normally the web interface or command line interface (CLI)). In some cases, the switch can be configured either way. SNMP configuration is normally the easiest. Consult the switch vendor's documentation to determine how sFlow can be configured, and for any specific instructions. See Appendix A, Configuring switches to send sFlow for additional information on configuring switches.

    SNMP configured sFlow
    If a switch supports SNMP configuration of sFlow, then sFlowTrend-Pro can do most of the configuration work. To do this, select Configure agents menu item. Click the Add button, and enter the IP address of the switch you wish to configure. The SNMP settings for the switch can also be changed from the default global settings here. Select OK on both dialogs to apply your changes. See Section 13.3.1, “Adding a switch configured via SNMP” for more information on configuring switches with SNMP.
    Manually configured sFlow

    To manually configure a switch to send sFlow, consult the switch documentation to determine the specific steps required. Normally, this is done through the web interface or the command line interface on the switch. Connect to the switch (say using a web browser, ssh or telnet). Follow the instructions for the switch to configure it to send sFlow to the IP address and UDP port that sFlowTrend-Pro is using to receive sFlow. You will also need to enable sFlow on one or more interfaces on the switch and set a sampling rate.

    As soon as sFlow reaches sFlowTrend-Pro, the switch will automatically be added to sFlowTrend-Pro. Even though the switch is not configured through SNMP, configuring sFlowTrend-Pro with SNMP settings that allow read access to the switch will allow information about the switch to be displayed in a more useful way. For example the interfaces can be displayed by name, rather than number. See Section 13.3, “Configuring agents in sFlowTrend-Pro for more information on this topic.

  9. If you have any hosts that support sFlow, or you are installing the host sFlow agent, then enable these to send sFlow to sFlowTrend-Pro. See Appendix B, Configuring hosts to send sFlow for more information on configuring host sFlow.

  10. When sFlowTrend-Pro starts to receive sFlow, the Dashboard tab, Status section, will display the incoming sample rate.

  11. Now that your switches are configured to send sFlow, they should be visible within sFlowTrend-Pro. In the Dashboard tab, the status bar will indicate how many switches are being monitored. The Dashboard tab highlights the busiest switch interfaces. See Chapter 3, The dashboard.

  12. Go to the Network tab, select the Top N sub-tab, and then use the Switch selector to view the traffic information for a specific switch. The default view shows top sources across all interfaces on the switch. You can change the chart displayed using the Chart selector, and view data for a specific interface using the Interface selector. See Section 4.3, “Top N” for more information on network traffic flows charts.

  13. To find quickly the interfaces on a switch that are busiest, select the Interfaces sub-tab. This will show a table of all the interfaces on the selected switch. By clicking on the column headings, you can sort by Utilization, Unicasts per second, etc. Once you have found an interface of interest, click the chart button, at the left-hand end of each row, to go directly to the charts for that interface. See Section 4.1, “Interfaces” for more information on this tab.