Placing a Flows Exporter

Finding the right place for a Flows exporter depends on the traffic you want to examine.

• To see who a user on the local network is connecting with outside the network, an exporter in an edge router or switch is usually best. Many firewalls are also capable of providing useful data.
• Internal traffic can be seen by looking at flows generated by a device on the network backbone.

Not all devices support exporting of flows data. Compared to SNMP, it is a fairly recent development, typically supported on higher-end equipment. The process of examining packet headers of passing data and storing, summarizing, and exporting the results is fairly resource-intensive.

Another approach to collecting and exporting flows data: mirror the traffic to a mirror or span port, and use a dedicated host to run a flows-exporter application to export flows data.