NetFlow issue

I'm little stuck on Solar Winds NetFlow, I don't seem to be able to see data generated by a pen test, so I know the port being hit, I know the interface on the public side and where the data is coming from but nothing is showing up on Netflow.

I must state that flow data is being exported for all interfaces on our firewall, Solar Winds winds is also configured to store data on those interfaces; also I can see flow data in general but not everything and I don't know why.

Any ideas?

Find more posts tagged with

Comments

verwin_u

@Rolfey83

You may use flow navigator to identify all necessary data from netflow.

https://documentation.solarwinds.com/en/success_center/nta/content/nta-creating-custom-views-with-flow-navigator-sw1200.htm

***note

- You must be familiar on source ip of pentest activity

- you must make sure that that pentest activity traverses in monitored interface in netflow and recorded in netflow monitor of the device.

saschg

Have a look at this setting:

https://documentation.solarwinds.com/en/success_center/nta/content/nta-configuring-the-nta-top-talker-optimization-sw343.htm?cshid=OrionNetFlowPHSettingsSmartTrafficOptimization

bourlis

Rolfey83,

If you're still having problems, then go back to the basics and build up from there.

(a) what's the machine type?

(b) validate if there are any netflow limitations with the machine type or with the OS.

i.e. - ingress & egress flow recorder commands, flow exporter commands, ingress & egress flow monitor commands, if applicable sampler commands & a physical and/or virtual interface command.