This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

No Netflow analysis???

I have had NetFlow installed and running on an Orion 9 SP3 server for a few weeks. When I checked the NetFlow Analysis page this morning I see data in the NetFlow Sources by Utilization but the charts are all "Chart Error - No Data".

I made sure that the app was running and even restarted it - same thing.

How can I troubleshoot - is there anywhere that could point out where the problem exists?

  • Hi,

    1- on the NetFlow home page, check the LAST DATA RECEIVED value in the NetFlow Sources resource.

    2- Check that the NetFlow Service is listening on the port you configured to be used (UDP 2055 by default) and

    in command line run: netstat -ab

    3- If the NetFlow service is correctly listening then run a network trace to ensure you are receiving the netflow statistics from these devices.

    Download Wireshark and install it on your Orion machine:http://www.wireshark.org/download/win32/wireshark-setup-1.0.5.exe

    Open it Click on Capture on the tool bar and select Interfaces Click on Option for the interface used to poll your devices.

    In the capture filter type the following:

    udp port 2055

    Click on Start to launch the capture.

    filter with the display filters on the ip addresses (ip-addr == xxx.ttt.sss.ttt) to match a specific node.

     

    This will tell us at least if the NetFlow stats are received by the Orion server and then troubleshoot either the NTA module, the Network or the Devices.

    HTH,

    Yann

  • Thanks Yann....

    I checked the LAST DATA RECEIVED and it was current and according to the NetFlow events it shows that the service is running and listening.

    The NetFlow service shows up in the results of Netstat -ab

    I wil have to try to get Wireshark on the server - might take awhile....