Not everyone wants to ingest PCAP due to space constraints and load exerted on all infrastructure components.  Netflow, while not a substitute for PCAP, is a high-level snapshot summary of network flows that would be contained in the PCAP files.  If one does not wish to ingest PCAP then at least enabling Netflow is recommended.  Metron uses YAF to generate IPFIX (Netflow) data from Metron's PCAP probe.  So the output of the probe is IPFIX instead of raw packets.  If Netflow is generated instead of PCAP then the netflow data goes to the generic Parsing topology instead of the PCAP topology

For related components see:

Parsing Topology

 

  • No labels