Flow Support

Horizon supports receiving, decoding, and persisting flow information sent via Netflow v5, Netflow v9, IPFIX, and sFlow. While flows offer a great breadth of information, the current focus of the support in Horizon is aimed at:

  • Network diagnostic: viewing the top protocols and top talkers within the context of a particular network interface.

  • Forensic analysis: persisting the flows for long-term storage.

How it works

At a high level:

  • Telemetryd receives and decodes flows on both Horizon and Minion.

  • Telemetryd adapters convert the flows to a canonical flow model and dispatch these to the flow repository.

  • The flow repository enriches the flows and persists them to Elasticsearch:

    • Flows are tagged with an application name via the classification engine.

    • Metadata related to associated nodes (such as IDs and categories) are also added to the flows.

  • The REST API supports generating both summaries and time series data from the flows stored in the flow repository.

  • Use OpenNMS Helm to visualize the flow data using the flow datasource that interfaces with the Horizon REST API.