Can InterMapper handle (NetflowV10) Flows Neflow/IPFIX v10?
Yes, InterMapper needs to be at 5.8.2 or higher to work with Netflowv10.
New IMFlows Exporter Parsers
In version 5.8.2, InterMapper Flows (IMFlows) has significant improvements for accepting newer export formats, including:
IPFIX, also known as NetFlow v10. (will be referred to as v10) Advanced use of NetFlow v9, such as newer forms of ASA/NSEL (will be referred to as v9)
The flexible template capabilities of both v9 and v10 can be processed by IMFlows. There are now three different kinds of exporter packet parsers for both v9 and v10 formats.
Three Kinds of Exporter Parsers
The first kind of parser is called a “generic” parser, so there is a “V9 generic” and “V10 generic” parser. The generic parsers try to intelligently parse the export packet's data, using heuristic methods that can recognize the most common templates. This approach is most similar to what earlier versions of IMFlows used.
The second kind of parser is called a “pre-defined format” parser. These parsers recognize pre-defined template formats that the generic parser cannot handle. IMFlows 5.8.1 and earlier versions could recognize ASA/NSEL for IPv4 only. IMFlows 5.8.2 can now recognize two pre-defined formats: the original “ASA/NSEL”, and a newer “ASA/NSEL 2”, which recognizes newer ASA/NSEL export formats.
The third kind of parser is called a “customer format” parser. These parsers use the same internal machinery as the pre-defined parsers; but they can be defined by a customer or can be a HelpSystems provided configuration file. This configuration file is put into the “/flows” folder and the next time the IMFlows server is started, these configuration files are read in. There is a separate file for v9 and v10. Their names are:
v9TemplateProcessing.conf
v10TemplateProcessing.conf
