Tags starting with netstat.netflow identify NetFlow event data.
Tag structure
There are two fixed tags depending on the version of NetFlow:
Tag | NetFlow versions supported |
|---|---|
netstat.netflow.lt | v1, v5, v6, v7 |
netstat.netflow.v9 | v9 |
For more information, read more about Devo tags.
Sending to Devo
NetFlow traffic should be forwarded to the dedicated, preconfigured NetFlow port 12999 on a Devo Relay for v7 and earlier. For v9 and later, Netflow traffic should be forwarded to the dedicated, preconfigured NetFlow port 12998 but it also needs an additional decoder installed (please contact Devo for this). All events received on these ports are tagged accordingly and forwarded securely to the Devo Cloud.