This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Nprobe configuration for Windows Server 2003

jschlotzhauer over 10 years ago

Hello,

I am attempting to configure nProbe on Windows Server 2003. I am having difficulty getting NTA to recognize the sources of my windows server as a Net Flow source. I have 2 interfaces connected to a spanned port on my Cisco 4510 catalyst switch. My interfaces area listed in CMD as follows:

0x1............................................MS TCP Loopback Interface

0x10003...00 1b fc de f0 b0 .....Marvell Yukon 88E8001/8003/8010 PCI Gigabit Ethernet Controller (Internet connected)

0x10004...00 1b fc de ee bd.....Marvell Yukon 88E8052 PCI-E ASF Gigabit Ethernet Controller

When Configuring the nProbe to sent NetFlow back to the server, I use the following

C:\Program Files\nProbe-Win32\ nprobe /r nprobe

nprobe /i nprobe -n 172.29.65.37:2055 -b 1 -u 3 -Q 4

I seem to get some netflow data for a while then it quits receiving data. Any suggestions on getting this up and running? Also I've disabled the firewall temporarily and this still does not seem to send the netflow data. Thanks in advance for your help.

Top Replies

donthomas over 10 years ago in reply to jschlotzhauer +1

Is it NTA not processing data or the Win 2003 nProbe installation not sending flows? Can you verify with Wireshark if you are receiving flows on the NTA server? If flows from nProbe are reaching the server…

0 jacob_beucler over 10 years ago

Hi, check these posts out, they are both relevant and may shed some light on the issue you are having.
http://thwack.solarwinds.com/community/solarwinds-community/product-blog/blog/2009/11/10/orion-nta-and-nprobe-analyzing-bandwidth-hogs-without-flow-capable-network-equipment
http://thwack.solarwinds.com/message/177945#177945
I think this may actually be the solution you are looking for...
http://thwack.solarwinds.com/message/91268#91268
Cancel
Vote Up 0 Vote Down

Cancel
0 jschlotzhauer over 10 years ago in reply to jacob_beucler

Hi Jacob,
Thank you for the information. I've read over these posts before as well. I am still having trouble getting the server to send the netflow data. It seems like it collects data for a while then stops, and the data it collects is in kbps whereas before it was in mbps and there was a lot more of it. I have had a successful iteration of nProbe running on a machine with Windows 7 OS, is the nprobe configuration different when installing on windows server? Just to clarify, I am using the spanned port (we'll call it port 1) as the -u to receive data and then the secondary port (we'll call it port 2) as the -Q to send the egress data? Thanks for your help
Cancel
Vote Up 0 Vote Down

Cancel
0 donthomas over 10 years ago in reply to jschlotzhauer

Is it NTA not processing data or the Win 2003 nProbe installation not sending flows? Can you verify with Wireshark if you are receiving flows on the NTA server?
If flows from nProbe are reaching the server, you could try without the -b option (which is for limited logging). I have read multiple threads about the below configuration working well:
nprobe /i -i 1 -n 192.168.1.1:2055 -u 1 -Q 1 (will re-install the service and send all the data from interface 1 (-i 1) to IP 192.168.1.1 on port 2055 with all traffic tagged as coming from interface index 1. Make sure the interface specified is monitored with NPM)
R,
Don
Cancel
Vote Up +1 Vote Down

Cancel