|Remove||Item||Quantity × Price|
|Your cart is empty|
Yes, it's 1st April but this is not a joke :) . It is pretty easy to get Netflow traffic from a managed Layer 2 (or 3) switch that does not export Netflow data by itself or, if you have to pay for the Netflow license on your device. You can obviously use if you have it an appliance like a Cisco NGA 3000 series, but if you are on budget you can setup an OSS software based solution.
To make such setup, you'll need to setup a Softflowd collector working on a mirrored port of the switch. Softflowd is available for most Linux distributions and guess it works pretty well also on other UNIXes too.
If you want to get the flows from an 802.1Q VLAN Tagged port, use this patched version. I have setup one in my lab on an APU2C4Devuan system that receives the mirrored traffic on eth0 from a TP-Link SG3424 and sends it over the eth2 port to my Samplicator (UDP Multiplexer) box that forwards it to all my collectors (I run several for testing). The APU2 CPU usage for now is about 1%.