Interface Netflow wrongly identified

Hi,

are you sure that it's about Interface ID and not about Interface Index? I think that you don't have managed interface with interface index 65535  and that's why NTA can't map interface index to interface ID.

In version 3.1 you need to have both interface managed, otherwise we drop input traffic.

This value 65535 (0xFFFF) seems to be some dummy index, right? You can set up your monitor to export both interface indexes (IN/OUT), or at least export zero value instead of 65535 which is accepted by NTA according RFC.

Thanks ET

Someone asked the same question in another post. Follow this link to see how to quickly map Interfaces indexes and their matching names:

Dear ET :),

thanks for the reply , yes you are right it is the "InterfaceIndex" which is the trouble.

SNMP only discovers one interface eth0 -> interfaceindex = 2, but the Netflow receives traffic from an interface having the index of 65535.

For tweaking the exporter I don't see those options, I would rather align NTA to the interfaceindex of 65535

Any thoughts?

Regards,

Andreas

Hi,

I wrote that 3.1 has limitation that both in/out interfaces need to be managed. Right now, you can upgrade to NTA 3.5, which eliminates this behavior and it requires only one interface. Unmanaged interface index will be automatically converted to zero, and your traffic will be only ingress/egress according which interface is valid.

So if you are not able to force exporter export zero values, solution for you is upgrade to 3.5

Hi,

actually I am already running 3.5 and the behavior is as described.

NetFlow Receiver Service [NETFLOW] is receiving a NetFlow data stream from an unmanaged interface on Test-04. The NetFlow data stream will be discarded. Please follow the link build-sles-11 or use the Orion System Manager to add Interface '#65535' in order to process this NetFlow data stream.

Best regards,

Andreas

And is your option [Allow monitoring of flows from unmanaged interfaces. Flow packets defined with only one unmanaged interface will no longer be discarded automatically.] enabled? This is disabled by default, so maybe .....

thanks