gravwell/netflow_capture repository overview

Use this to ingest netflow data into a Gravwell instance. If you're running a fully Dockerized Gravwell instance, you'll need the core Gravwell⁠ container already running to use this.

By default, the ingester will listen for Netflow data on port 2055, ingesting to tag "netflow"; full documentation is availble⁠.

See the netflow⁠ and ipfix⁠ processing module documentation for more info on interacting with netflow data once you are ingesting.

Refer to Gravwell's Docker guide⁠ for information on how to deploy ingester containers.

Note: Because this is a Linux application, we strongly recommend running under Docker on a Linux host. Performance may suffer on other operating systems. MacOS users cannot access containers directly by IP, because the containers are actually run within a Linux VM. You can either use netcat from within a Docker container (either the same container or a new one), or forward port 2055 to the host when launching the Gravwell container