Configure Flow Cloner Options

Initial Configuration › Set Up Flow Cloning › Configure Flow Cloner Options

Configure Flow Cloner Options

To configure the Flow Cloner, modify its default initialization (.ini) file. The .ini file contains a header line followed by a line for each destination host--each host that will receive the cloned packets. If you do not specify values for the header fields, the default values are used. You must specify at least one destination host.

For information about the configuration file conventions, including how to comment out lines or fields, see Conventions for Flow Cloner Configuration Files.

Follow these steps:

Log in to the Flow Cloner installation server as a user who has administrator privileges.
Open the following file in a text editor: <install_path>\Netflow\FlowCloner\flowclonedef.ini.
The .ini file has a header line followed by a line for each host that will receive packets.
Customize the header line:
The header content must be contained in a single line,--the first non-commented and non-blank line in the file.
- To use the default value for the input NIC, replace the entire header line with the following token:
```
/use defaults
```
  You can follow the /use defaults token with a comment, as shown in the following example:
```
/use defaults; take default setup
```
  The program uses the first available NIC to send cloned data on port UDP 9995. The /use defaults token takes effect only if the header does not contain any other tokens.
- (Optional) To specify the listening port, enter the /port= token, followed by the port the destination hosts use to listen for the cloned data.
  Default: UDP 9995
  
  Note: The Flow Cloner listening port must be the same listening port that the Harvesters use and that the routers are configured to use as the destination port.
- (Optional) To specify the Input NIC, enter the /listen ip= token, followed by the IP address for the NIC on which the Flow Cloner listens for packets.
  Default: First functional IP address of the host.
For examples, see Examples of Flow Packet Cloner Configuration Files.
Specify one or more hosts that will receive the cloned packets:
Enter each host on a separate line, which consists of the dest ip= token and IP address of the destination host. You can put the destination host lines in any order.

Example:
```
/dest ip=10.0.0.100 ; send cloned packets to to 10.0.0.100
```
If the IP address is missing, the line is ignored.
Save and close the FlowCloneDef.ini file.
Start the CA NFA Flow Cloner service on the Harvester server.
The Flow Cloner is enabled and attempts to forward packets to each valid destination that you specified. Flow cloning continues until you stop the CA NFA Flow Cloner service manually.

The CA NFA Flow Cloner service is configured to start automatically on reboot and start sending cloned flow data. To operate the Flow Cloner only on demand, change this configuration in the Services window. The service cannot run if the configuration file does not identify at least one destination IP address.

Also see: