6 Replies Latest reply on Jul 9, 2009 12:13 AM by ET

    Interface Netflow wrongly identified

    idaho51

      Hello all,

       

      I am trying to monitor a Linux server network interface with Netflow.

      I got the Netflow running and NTA is receiving data. Problem now is that NPM discovers the machine with SNMP and one eth0 interface with the interfaceid of "2".

      Netflow is receiving traffic from an interface '65535', which doesn't know on how to match to the SNMP discovered interface id.

      There used to be the way to manual change the id in the DB, but each time you restart the NPM it is overwritten with the SNMP discovered value.

      Any ideas on how to get it running?

       

      Best regards,
      Andreas

        • Re: Interface Netflow wrongly identified
          ET

          Hi,

          are you sure that it's about Interface ID and not about Interface Index? I think that you don't have managed interface with interface index 65535  and that's why NTA can't map interface index to interface ID.

          In version 3.1 you need to have both interface managed, otherwise we drop input traffic.

          This value 65535 (0xFFFF) seems to be some dummy index, right? You can set up your monitor to export both interface indexes (IN/OUT), or at least export zero value instead of 65535 which is accepted by NTA according RFC.

          Thanks ET

            • Re: Interface Netflow wrongly identified
              idaho51

              Dear ET :),

               

              thanks for the reply , yes you are right it is the "InterfaceIndex" which is the trouble.

              SNMP only discovers one interface eth0 -> interfaceindex = 2, but the Netflow receives traffic from an interface having the index of 65535.

              For tweaking the exporter I don't see those options, I would rather align NTA to the interfaceindex of 65535

               

              Any thoughts?

               

              Regards,

              Andreas

                • Re: Interface Netflow wrongly identified
                  ET

                  Hi,

                  I wrote that 3.1 has limitation that both in/out interfaces need to be managed. Right now, you can upgrade to NTA 3.5, which eliminates this behavior and it requires only one interface. Unmanaged interface index will be automatically converted to zero, and your traffic will be only ingress/egress according which interface is valid.

                  So if you are not able to force exporter export zero values, solution for you is upgrade to 3.5

                    • Re: Interface Netflow wrongly identified
                      idaho51

                      Hi,

                       

                      actually I am already running 3.5 and the behavior is as described.

                       

                      NetFlow Receiver Service [NETFLOW] is receiving a NetFlow data stream from an unmanaged interface on Test-04. The NetFlow data stream will be discarded. Please follow the link build-sles-11 or use the Orion System Manager to add Interface '#65535' in order to process this NetFlow data stream.

                       

                      Best regards,

                      Andreas

                • Re: Interface Netflow wrongly identified
                  Yann

                  Someone asked the same question in another post. Follow this link to see how to quickly map Interfaces indexes and their matching names:

                  Re: adding interfaces - comparing apples to snowplows ??