Errors in Network Flow Traffic Analyzer when using HP Switch

Hello ,

My customer is using Network flow traffic analyzer to monitor HP Gbe2c switches. However they are seeing the following messages in Network flow traffic analyzer summary.

"netflow receiver service is receiving a netflow data stream from an unmanaged interface( XXX.XX IP address). The netflow data stream will be discarded . Please use orion node management to manage interface #1 in order to manage this inetflow data stream or just use Edit this service.

Again logged for interface 2

"netflow receiver service is receiving a netflow data stream from an unmanaged interface( XXX.XX IP address). The netflow data stream will be discarded . Please use orion node management to manage interface #2 in order to manage this inetflow data stream or just use Edit this service

What is the cause of this error how can I resolve this.

Many thanks,

Sharad

Find more posts tagged with

Accepted answers

All comments

mavturner

This is usually caused when a device is sending Netflow data but you are not managing the device in NPM. Also, if the IP address you are managing is different than the IP address that the Netflow packets are coming from then you can get this message.

mishrsha

Hello Mav,

Many thanks for your reply.

While we are investigating this . My customer believes

Problem is the inability to match the port number received by sFlow to the port number received by snmp. Switch send sFlow statistics port number interface (eg a 1), software receives the data and tries to bind it to port number, software makes request via snmp and looking for a port with index 1, and finds no such interface .

For example, other software for statistical work the same way.
On devices ProCurve, Cisco such problems do not occur and everything works fine.

P.S. The main problem is that the switch ports on their indexes 261, 262,... and sFlow statistics use port numbers.

Question

Is it not possible to read data from interface index numbers and not physical port numbers in Network Flow Analyzer.

I installed another tool and there I am able to read the data..

Thanks in advance for your response.

Regards,

Sharad

mavturner

Sharad,

NTA requires the interface index in the flow to match an interface index of a currently managed node. If you look at the interface details page, you will see the interface index (see screenshot below). Depending on the exact device, you should be able to configure how sFlow behaves and what index it sends. If you want to just check yourself, you can run a packet sniffer (ie: Wireshark) on the server with NTA installed and look to see what the source interface index is and make sure it matches an index ID from a managed interface in NPM (in my example below, the interfaces don't match up because they are taken from different devices).

Mav

ifIndex.PNG

mavturner

Wireshark capture of output index from device.

Interface.PNG

FormerMember

I just checked one of our Procurve 2910's. They are using the port # as the SNMP index and Sflow collection by NTA works fine. Maybe a firmware issue?

FormerMember

Our procurve 2910's work fine.

mishrsha

Hi Mav,

Thanks for your response. While I install wireshare as per your suggestion . I hope you can answer the below query.

My switch supports only sflow . Does the NTA supports both slfow and Netflow..

Where can I see the slfow data received in NTA or NPM ?

Regards,

Sharad

mavturner

As pyro13g mentioned, NTA works with sFlow just fine. You would see the sFlow data in the NTA module and it would look like any other flow type (Netflow, j-flow, etc.).

Mav

mishrsha

Hi Mav, Pyro13g,

Thanks for your response.

The issue is not with the Procuvre switch. It is with HP Gbe2c L2/l3 blade switch..

Regards,

Sharad