NetFlow v9

See Flow Support for details on flow support in Horizon.

Netflow v9 UDP Parser

The Netflow v9 UDP parser accepts packets received by a UDP listener and must forward them to a Netflow v9 adapter.

The Netflow v9 UDP parser supports protocol detection.

Facts

Class Name

org.opennms.netmgt.telemetry.protocols.netflow.parser.Netflow9UdpParser

Parameters

Table 1. Parameters for the Netflow v9 UDP Parser
Parameter	Description	Required	Default value
`templateTimeout`	Templates must be re-declared in the given duration or they will be dropped.	no	30 minutes
`maxClockSkew`	The maximum delta in seconds between exporter and Minion timestamps.	no	0
`clockSkewEventRate`	Used to rate-limit clock skew events in seconds.	no	3600
`dnsLookupsEnabled`	Used to enable or disable DNS resolution for flows.	no	true
`sequenceNumberPatience`	A value > 1 enables checking for seuqence number completeness. The value gives the size of the history buffer allowing flows to be processed out of order.	no	32
`flowActiveTimeoutFallback`	Fallback value for active flow timeout if setting value is not included in exported flows	no	null
`flowInactiveTimeoutFallback`	Fallback value for inactive flow timeout if setting value is not included in exported flows	no	null
`flowSamplingIntervalFallback`	Fallback value for sampling interval if setting value is not included in exported flows	no	null

Netflow v9 Adapter

The Netflow v9 adapter handles Netflow v9 payloads received and parsed by by the Netflow v9 UDP Parser. Flows are decoded from the messages into the canonical flow format and are published to the flow repository.

Facts

Class Name

org.opennms.netmgt.telemetry.protocols.netflow.adapter.netflow9.Netflow9Adapter

Parameters

This adapter does not currently have any configurable parameters.

The parameter maxClockSkew in your parser definition enables clock skew detection for exporters. It specifies the maximum delta in seconds between exporter and Minion time stamps. If exceeded, an alarm will be generated for the exporting device. The default value is 0, so clock skew detection is disabled. Furthermore, a parameter clockSkewEventRate can be used to rate-limit clock skew events. The default is 3600 seconds, so every hour an event will be sent.