Configure Flow Cloner Options

Making Additional Customizations › Set Up Flow Cloning › Configure Flow Cloner Options

Configure Flow Cloner Options

To configure the Flow Cloner, modify its default initialization (.ini) file. The .ini file contains a header line followed by a line for each destination host--each host that will receive the cloned packets. You must specify at least one destination host. If you do not specify values for the header fields, the default values are used.

For information about configuration file conventions, including how to comment out lines or fields, see Conventions for Flow Cloner Configuration Files.

Follow these steps:

Log in to the Flow Cloner installation server as a user who has administrator privileges.
Open the following file in a text editor: <install_path>\Netflow\FlowCloner\flowclonedef.ini.
The .ini file has a header line followed by a line for each host that will receive packets.
Customize the header line:
The header content must be contained in a single line--the first non-commented and non-blank line in the file.
- To use the default value for the input NIC, replace the entire header line with the following token:
```
/use defaults
```
  You can follow the /use defaults token with a comment, as shown in the following example:
```
/use defaults ; use first available NIC and port 9995 to listen and send flows on the first available NIC
```
  The program uses the first available NIC. The hosts listen for the original flows and cloned flows on port UDP 9995. The /use defaults token takes effect only if the header does not contain any other tokens.
- (Optional) To specify the listening port, enter the /port= token, followed by the port number. The Harvester that receives the original flows listens on UDP 9995 unless you use the /port token to specify a different port.
  Default: UDP 9995
- (Optional) To specify the destination port, enter the /dest port= token, followed by the port number. The hosts that receive the cloned flows listen on UDP 9995 unless you use the /dest port token to specify a different port. All of the hosts listen for the cloned flows on the same port.
  Default: UDP 9995
- (Optional) To specify the Input NIC, enter the /listen ip= token, followed by the IP address for the NIC on which the Flow Cloner listens for packets.
  Default: First functional IP address of the host
For examples, see Examples of Flow Packet Cloner Configuration Files.
Specify one or more hosts that will receive the cloned packets:
Enter each host on a separate line, which consists of the dest ip= token and IP address of the destination host. You can put the destination host lines in any order.

Example:
```
/dest ip=10.0.0.100 ; send cloned packets to 10.0.0.100
```
If the IP address is missing, the line is ignored.
Save and close the FlowCloneDef.ini file.
Start the CA NFA Flow Cloner service on the Harvester server.
The Flow Cloner is enabled and attempts to forward packets to each valid destination that you specified. Flow cloning continues until you stop the CA NFA Flow Cloner service manually.

The CA NFA Flow Cloner service is configured to start automatically on reboot and start sending cloned flow data. To operate the Flow Cloner only on demand, change this configuration in the Services window. The service can run only if the configuration file identifies at least one destination IP address.

Also see: