NetFlow Packets Ignored or Not Formatted Properly?

Hi,

the issue is, that both InputInterfaceIndex(InputInt) and OutputInterfaceIndex(OutputInt) are zero. If this happend, we can't map traffic to interface managed by Orion and we must drop this traffic.

ET;

Thanks ET.  Not sure how to fix that.  When I change the export to version 9 I get the same result - nothing.  Packet capture of v9....

Sorry, I'm developer, I don't know how to configure your router to export valid data Let's wait for some network engineer to resolve your problem.

Can you share you sflow config? I may be able to help you from that and a model number.

Andy

Hi Andy, sorry for the confusion, the sFlow data I collect from my Extreme switches is fine, other than being able to collect egress traffic only.

The issue I am having is setting up the FreeBSD-based pfSense routers to send properly formatted NetFlow data.

Aaron

Hi Aaron,

Is ther a config option for interfaces on the pfSense software or is it just on/off?

There is a config option - it appears as though I can only enable it for one interface at a time.  My config has one physical interface hosting numerous VLANs, so I tried enabling it first for the physical interface that hosts the VLANs, and then for a single logical VLAN interface.  Either way, using v5, I would end up with the data showing zero as the input and output interface ID's as noted above.  When I change to v9 I get the info shown above.  Using Wireshark I do see the packets referencing the correct traffic cross the interface (physical or VLAN), but something is not agreeing with NTA.

The exporter must have the source IP, source port, sourceIf, ToS, dest IP, dest Port and protocol to show up in NTA. Several of these are missing from that export.

And in that regard, I have no idea how to make the add-on package send out what it should.  I haven't found much info on getting these packages to work well, and I have never found any info from anyone that was able to get something working with Orion (only other collectors).

N probe does but its Win32 based.