Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

NetFlow Packets Ignored or Not Formatted Properly?

I have a lot of sFlow data being collected from Extreme switches. I just recently set up one of our BSd-based routers (pfSense) to export NetFlow data. However, NTA does not display any of the info and seems to act like it is ignoring all packets being sent to it from this router. I have used Wireshark to look at what is coming into the server, and I do see the flow packets coming on the correct port (2055), and that port is added to the NAT config. So, I am looking for help is seeing if there is an issue with the format of the packets coming from the router (pfSense running softflowd). And if not, then any other ideas?

Screenshots of Wireshark captures:

Thanks in advance.

Aaron

Find more posts tagged with

Accepted answers

mcbridea

The exporter must have the source IP, source port, sourceIf, ToS, dest IP, dest Port and protocol to show up in NTA. Several of these are missing from that export.

All comments

Hi,

the issue is, that both InputInterfaceIndex(InputInt) and OutputInterfaceIndex(OutputInt) are zero. If this happend, we can't map traffic to interface managed by Orion and we must drop this traffic.

ET;

acherman

Thanks ET. Not sure how to fix that. When I change the export to version 9 I get the same result - nothing. Packet capture of v9....

Sorry, I'm developer, I don't know how to configure your router to export valid data Let's wait for some network engineer to resolve your problem.

mcbridea

Can you share you sflow config? I may be able to help you from that and a model number.

Andy

FormerMember

I have a similar problem to the one shown here. We have a network of 3750 switches that won't do NetFlow, so we set up SPAN ports and pushed the traffic to a Linux box. The Linux box is using SoftFlowd to format the NetFlow stream and send it to my Orion NTA server. When I run a WireShark capture, I get something similar to what you see above - the source/destination IPs and ports are coming through, but the InputInt and OutputInt and ToS show zero.

I'm definitely getting a steady stream of NetFlow data from the Linux box, but NTA doesn't appear to be accepting or processing any of it. Has anyone else run into this situation, and can you suggest a fix?

Thanks.