18 Replies Latest reply on Jan 27, 2009 1:20 PM by andrei.arnautu

    NetFlow data stream will be discarded error

    kreischl

      I am getting this error when working with my main switch (a lot of interfaces are listed)

      NetFlow Receiver Service [NETMON1] is receiving a NetFlow data stream from an unmanaged interface on <ip address>. The NetFlow data stream will be discarded. Please use the Orion System Manager to add Interface #596 in order to process this NetFlow data stream.

       The device I am working with is an Enterasys N7 switch. 

      In the NTA settings, I've tried having all ports selected or just the ports I have configured for export on the N7 and I get the same problem.

      I did notice that the checkbox doesn't stick for the main device even when I have all of the ports selected. (See attached)

      No luck working with the other posts in this forum. 

      (I have this working on my Packeteer device)

       

      N7 config:

      ==============
      show netflow config

      Cache Status:           enabled
      Destination IP:      <ip address>
      Destination UDP Port:      2055
      Export Version:               5
      Export Interval:              5 (min)
      Number of Entries:       786431
      Inactive Timer:              40 (sec)
      Template Refresh-rate:       20 (packets)
      Template Timeout:            30 (min)

      Enabled Ports:
      -----------------
      ge.1.1
      ge.3.49-50
      fe.7.1-2
      ge.7.1-6

      Disabled Ports:
      -----------------
      lag.0.1-48
      ge.1.2-30
      ge.2.1-30
      ge.3.1-48,51-54
      fe.7.3-24

       

        • Re: NetFlow data stream will be discarded error
          denny.lecompte

           That message means that the device/interface is not being managed by Orion.  Add the node and all its interfaces via System Manager.

            • Re: NetFlow data stream will be discarded error
              kreischl

               I added all interfaces in system manager and added all interfaces in NTA settings and I get the same problem.

                • Re: NetFlow data stream will be discarded error
                  denny.lecompte

                  Well, that was the easy solution.  I think you'll need to open a Support ticket because we'll need to gather some info to figure out what's going on. 

                    • Re: NetFlow data stream will be discarded error

                      Same here... facing the same problem. any solutions yet? 

                        • Re: NetFlow data stream will be discarded error
                          kreischl

                           I was instructed to call in and open a support ticket but I decided to instead migrate from Novell to Microsoft.  :-)

                          Maybe next week I can break away for an hour to call in.

                          What equipment are you using?


                           

                            • Re: NetFlow data stream will be discarded error

                              I recommend checking out the thread at The specified item was not found..  This includes steps for verifying that the appropriate interfaces are being managed as NetFlow sources.

                                • Re: NetFlow data stream will be discarded error

                                  im getting a:

                                   

                                                 
                                                      
                                     
                                         

                                  Not Found: Forum Not Found

                                         
                                  The forum you requested does not exist.
                                     
                                                   
                                            
                                    • Re: NetFlow data stream will be discarded error

                                       Ahhh...that is a beta protected thread.  The gist of the discussion is as follows:

                                       

                                      I recommend double-checking that the interface, index #xx for <ip address>, referenced in the Event Log is added in Orion.  You can verify the interface is monitored in Orion by clicking on View > Interfaces within the System Manager, locating the Node Name and referring to the Interface Index field.  If you do not see the Index field, simply select View > Customize Current View.., check the Interfaces > Indexes box, and click OK.  Note that the Interface Index field is not the same as the Interface ID field.  If the interface is managed in Orion, then I recommend double-checking that the interface is listed as a monitored source within NetFlow settings.

                                        • Re: NetFlow data stream will be discarded error

                                          I noticed something wired, I can´t get netflow data out of my 7513, but configured a 3640 and data flow OK! whats wrong here?

                                           

                                          I install and configured netflo analyzer 6.1 from manageengine and there went ok! is netflow from solarwinds different? 

                                          • Re: NetFlow data stream will be discarded error
                                            msteffes

                                             Ahhh...that is a beta protected thread.  The gist of the discussion is as follows:

                                             

                                            I recommend double-checking that the interface, index #xx for <ip address>, referenced in the Event Log is added in Orion.  You can verify the interface is monitored in Orion by clicking on View > Interfaces within the System Manager, locating the Node Name and referring to the Interface Index field.  If you do not see the Index field, simply select View > Customize Current View.., check the Interfaces > Indexes box, and click OK.  Note that the Interface Index field is not the same as the Interface ID field.  If the interface is managed in Orion, then I recommend double-checking that the interface is listed as a monitored source within NetFlow settings.

                                             

                                            It is rather easy to figure out the Interface Index field for a particular device. Orion seems to use a 4 digit number for devices that have slots. So, if the first number of the index is 7 it is referring to slot 7, and if the next numbers are 013 then it is referring to port 13 so port 7:13. If it is only a two digit number then the device is a single blade and refers directly to a port. I haven't quite figured out how to do Cisco routers but I will post once I figure it out.
                                              • Re: NetFlow data stream will be discarded error

                                                 We ran into the same problem, we are getting netflow statistics from some non cisco gear on our network.

                                                 

                                                In the netflow packet that gets sent out from the router to Orion it will contain a index value.  This index value comes from the interface that the traffic was seen on.  For example: lets say the netflow packet looked something like this:

                                                SrcAddr: someip

                                                DstAddr:someip

                                                InputInt: 5

                                                outputint: 4

                                                packets: 1

                                                octests: 81

                                                etc...

                                                On cisco devices the input int and output int are equal to the snmp interface index.

                                                I know that nprobe(a netflow colector program) will generate a pseudo random number for that input and output int. when Orion recives this it is looking for an interface index which it doesent, and cant really know about.

                                                The workaround that i have used is I create a custom interface with the index that is needed to collect the data.

                                                Here is my list of known software that will have this issue:

                                                nprobe

                                                pfflowd

                                                 ____________

                                                In short to trouble shoot this issue I would do a snmp query and see if the interface index that orion is complaining about even exists on the device.

                                                Andrew Weidlich

                                                aweidlich@pcccinc.com

                                                  • Re: NetFlow data stream will be discarded error
                                                    Josh Stephens

                                                    For the Enterasys switches, this is an issue with the implementation of NetFlow version 5 on the switches. An easy workaround is to use NetFlow v9 instead.

                                                    The reason for the issue is that the Enterasys switches us 32-bit interface indexes and within NetFlow v5 the interface index field is only 16-bit. For this reason, Enterasys leverages the bridge MIB index within the NetFlow records and then provides a mapping table within their NetFlow MIB. In NetFlow v9 the field size is flexible so the issue doesn't exist.

                                                    Flame on...
                                                    Josh

                                                • Re: NetFlow data stream will be discarded error

                                                   Hi,

                                                  I've been having same issue on HP ProCurve 2610. I've noticed the index # of the interface reported to be unmanaged does not exist. I went to View>Interfaces and it's not there. I've tried removing the node from Sys Manager and adding it back including all interfaces... and still reported index number does not match any of the interfaces. We've also tried restarting services before, and after node was added... no luck

                                                  Thx

                                                  Update:

                                                  When above node is removed from Orion it complains about traffic coming from unmanaged interface index#5. Once node is added, and interface #5 is authorized to receive netflow packets, the event window starts complaining about unauthorized traffic on interface index#1073741823. None of interfaces match that number...

                                                  Thx

                                          • Re: NetFlow data stream will be discarded error


                                            Same here... facing the same problem. any solutions yet? 

                                             

                                             

                                            We have identified an issue where the following steps require the user to restart the NetFlow service in order for NetFlow to detect the newly added interface.

                                            1. The device is added in the Orion System Manager
                                            2. Only a select number of interfaces are monitored within Orion
                                            3. The device and its monitored interfaces are added as NetFlow sources
                                            4. NetFlow provides a message indicating that NetFlow traffic is received on an unmonitored interface
                                            5. The unmonitored interface is added to Orion System Manager to be monitored
                                            6. The newly added interface is selected as a NetFlow source in NetFlow Traffic Analyzer.

                                            NetFlow is not detecting the new interface until the service is NetFlow Traffic Analyzer service restarted.

                                            If this does not resolve the issue, please let us know. 

                                              • Re: NetFlow data stream will be discarded error

                                                Dear,

                                                 

                                                I have tried all the mentioned steps where:

                                                1. The device is added in the Orion System Manager
                                                2. Only a select number of interfaces are monitored within Orion
                                                3. The device and its monitored interfaces are added as NetFlow sources
                                                4. NetFlow provides a message indicating that NetFlow traffic is received on an unmonitored interface
                                                5. The unmonitored interface is added to Orion System Manager to be monitored
                                                6. The newly added interface is selected as a NetFlow source in NetFlow Traffic Analyzer.

                                                And still facing the same problem of recieving traffic on " Unmanaged Interface" and not able to receive netflow data thus loosing track of my upstream traffic analysis and our links are getting congested.

                                                 

                                                I already opened a ticket but I was hoping to find a quicker remedy in the forum

                                                 

                                                Raed Jabak

                                                Orion Admin

                                                Saudi Telecom

                                                  • Re: NetFlow data stream will be discarded error


                                                    Dear,

                                                     

                                                    I have tried all the mentioned steps where:

                                                    1. The device is added in the Orion System Manager
                                                    2. Only a select number of interfaces are monitored within Orion
                                                    3. The device and its monitored interfaces are added as NetFlow sources
                                                    4. NetFlow provides a message indicating that NetFlow traffic is received on an unmonitored interface
                                                    5. The unmonitored interface is added to Orion System Manager to be monitored
                                                    6. The newly added interface is selected as a NetFlow source in NetFlow Traffic Analyzer.

                                                    And still facing the same problem of recieving traffic on " Unmanaged Interface" and not able to receive netflow data thus loosing track of my upstream traffic analysis and our links are getting congested.

                                                     

                                                    I already opened a ticket but I was hoping to find a quicker remedy in the forum

                                                     

                                                    Raed Jabak

                                                    Orion Admin

                                                    Saudi Telecom

                                                     

                                                     

                                                     

                                                    Just to double-check, have you restarted the NetFlow service? 

                                        • Re: NetFlow data stream will be discarded error

                                          Go to Netflow traffic Analysis page.  You will there see an error :

                                          "NetFlow Receiver Service [hostname] is receiving a NetFlow data stream from an unmanaged device (x.x.x.x). The NetFlow data stream from x.x.x.x will be discarded. Please use the Orion System Manager to add this IP Address in order to process this NetFlow data stream."

                                          Go to system manager see if the device that has that IP is managed, check if that interface is managed, then right click on the device and make sure that under Node Details the IP address of the device is x.x.x.x

                                          This should fix your problem if you've done all the steps to configure it properly.