sFlow, Netflow or IPFIX duplication to multiple servers

If you need to feed same sFlow, Netflow or IPFIX traffic to multiple consumers and your switch or router does not support multiple targets, we suggest using external tool for it. We have good experience with samplicator.

You can install it this way.

Install build dependencies:

sudo apt-get install -y automake gcc

Build tool:

cd /tmp
git clone https://github.com/sleinen/samplicator.git
cd samplicator
./autogen.sh
./configure 
make

Copy binary to /opt:

sudo cp samplicate /opt

And start it:

sudo /opt/samplicate -S -p 2056 8.8.8.8/2055 9.9.9.9/2055

It will receive messages on port 2056 on local machine and forward to:

8.8.8.8/2055
9.9.9.9/2055

Flag -S is extremely important because it will spoof original IP address of router and both recepients will see original IPs of router. It’s crucial to do it as for Netflow v9 and IPFIX protocols it’s mandatory requirement and lack of this flag will cause traffic corruption or even collector crashes.