receiving a NetFlow data stream from an unmanaged interface

The issue may be that traffic is flowing through other unmanaged interfaces on your switches to the one managed interface that is exporting flows.

I would suggest enabling "monitoring of flows for unmanaged interfaces".   The consequence of this is that if at least one of the interfaces contained in the flow is managed, the NetFlow data should not be dropped.

I asked the same question a while back and was told to the messages can not be blocked. I am monitoring flows on my t1 circuit, data vlan, and voice vlan. I get a message that it is receiving flows from the loopback interface. if i change to monitor the loopback, i get messages saying that it is getting flows from T1, data, and voice vlans. Either way i get the same info in the flow, but i get less messages the first way. I have yet to find a way to stop that message.

Hi Chris

Thanks for your reply..

This is also the conlusion that I have reached. And I know that I can use the "monitoring of flows of unmangede interfaces", So this will proberly be my solution.

Do you know how the netflow engine react, if "someone" in our organisation, have configure another router to send netflow packets to NTA, and this router is not in the NPM and we don't want to recieved netflow from this router. Will these packets be discardet???

What I worry about here is that the Data the NTA is giving me are'nt correct?

I have been sniffing my netflow packets, and I can se da my source snmp interface index is always #50, witch matches my vlan 1107 where I have my "ip flow ingress" on.

But my destination snmp interface index various depanding where the traffic is going. This should be normal behavier for netflow packets.

So the traffic I'm recieving are always flowing throug my "managed inteface" which are netflow enable om my router and to one of my destination interfaces.

I suspect the Solarwinds Netflow engine to look at these destination snmp interface index, and if the destination snmp interface index is not manage it will create a "unmanaged interface" error and discard the packet, I'm I totatlly wrong here????

Or is there another explanation on this?

Thanks

Kenneth

Turning on monitoring of flows for unmanaged interfaces does allow you to monitor the flows from those interfaces, but you will still have the error messages saying that you are recieving flow from unmanaged interfaces. Also, you want to be careful about which interfaces you pull flows from, as you can start getting double data. Example would be monitoring the serial interface of a router and the data sub interface of the ethernet, you will get any data from the ethernet interface + you will get the same data as it passes through the serial interface and it will throw your numbers off.

Just FYI, we're working on fixing the extraneous event log entry issue.   If you have "monitoring of flows from unmanaged interfaces" option enabled, we'll suppress the "flows from unmanaged interface detected" event log entries since you have explicitly agreed that this behavior is acceptable.

Hi...

Besides this thread I have also created a Ticket at SolarWinds, and I got this answer

Error [received traffic from unmanaged interface] means, that one of interface in flow is not managed by Orion, so we can't map interfaceIndex to InterfaceID. By default we require both interfaces be managed by Orion. If user don't want to manage all interfaces for some reason, he need to enable option [Monitoring of flows from unmanaged interfaces] in NTA admin section. Than all unmanaged interface indexes will be replaced by zero and warning message that we drop traffic will be fired only in case, that both interfaces in flow are unmanaged by Orion."

I know now that my NTA is "working as designed"

And in my case, as earlier told, I will go with "Monitoring of flows from unmanaged interfaces".

Thank you all, for your replies