Questions tagged [netflow]
The netflow tag has no usage guidance.
53
questions
0
votes
0
answers
128
views
How to have multiple instances of filebeat load balance Netflow input?
I have a very high volume Netflow input stream, and I was hoping that I could run multiple instances of Filebeat and load-balance the Netflow traffic over the Filebeat instances, and then write to a ...
- 211
0
votes
0
answers
197
views
Trying to understand nfdump output
I am trying to figure out meaning in a nfdump output, but I cannot seem to find any sources for this. For now I am mostly trying to understand what some of the categories mean.
What I have is a basic ...
- 1
0
votes
0
answers
19
views
Solarwinds Netflow Generator is crashing with file not found
I am using this tool from Solar Winds to generate v9 Netflow events.
It was working until an OS update a few days ago. Now, it starts, but when I generate events it crashes every time. I have tried ...
- 123
0
votes
2
answers
200
views
Netflow records with Destination Ports 1025,257 and Protocol as ipv6-icmp
I have some Netflow records from a bunch of routers. The records contain IPv6 flows and there are entries with protocol as ipv6-icmp and their destination port values as 0, 1025 and 257. I know from ...
0
votes
1
answer
680
views
Palo Alto and nfdump: No matched flows
I am new to netflow so maybe I have the problem is about understanding, but I have not found references on what is happening.
I have a Palo Alto PA500 firewall and I am trying to extract netflow ...
- 101
0
votes
0
answers
185
views
IPFIX Flows from OVS Linux Bridge are not accurate
I’m struggling to understand my IPFIX flow data.
To explain: I have an Ubuntu (16.04.2 LTS Xenial Xerus) box, and within that box, I have a single Linux bridge:
root@Ubuntu1:~# ovs-vsctl show
...
- 131
1
vote
0
answers
53
views
Encapsulate udp traffic info tcp with on-disk buffering
My ipfix flow receiver supports only udp (can't be replaced), which is not resistant to network failures and then I'm loosing flow data. To improve this I'm thinking about using socat, mkfifo between ...
- 11
1
vote
1
answer
767
views
Azure change destination IP NAT to local VM
We have an Azure Windows VM created with Inbound security rules allowing UDP/9999 for Netflow traffic. From the Windows VM we can capture traffic destined for the server. The packets are showing the ...
- 11
1
vote
0
answers
668
views
Cisco Netflow exporter inactive
I have difficulty configuring Netflow on Cisco router ASR 1001
flow record FLOW-RECORD-1
match ipv4 source address
match ipv4 destination address
match ipv4 protocol
match ipv4 tos
match ...
1
vote
1
answer
845
views
Monitoring DHCP clients bandwidth usage in and out
I have some locations that are running pfSense routers. I attempted to use the softflowd to send data to NFSen thinking that if it came from the LAN interface it might show the bandwidth per IP at ...
- 3,931
0
votes
2
answers
2k
views
Monitoring traffic using Netflow: port mirroring or streaming?
We have a router that we need to monitor using NetFlow. The router is very important, so we are not allowed to enable Netflow on the router itself. Instead, it will have port mirroring enabled so ...
- 171
-1
votes
1
answer
603
views
Udp session Netflow
How netflow defines the end of the udp session. That is, as I understand, there must be some timeout in the absence of requests from the dynamic port with the passage of time after which a new session ...
- 3
0
votes
1
answer
646
views
How do I generate a source of netflow data for nfcapd?
I am trying to use nfcapd to save netflow files for use by a network analysis tool.
How do I capture network traffic on my host and send it into nfcapd? Can I use wireshark/tshark or something ...
- 351
1
vote
1
answer
480
views
Logstash netflow plugin configuration error
I'm trying to use logstash to collect traffic information from VMware ESXi using the netflow plugin.
I've installed the latest version of logstash and elasticsearch from www.elastic.co on Ubuntu 16....
- 161
0
votes
1
answer
115
views
What is a Netflow?
I am a little confused with the definition of the "NetFlow" sense. Does NetFlow declare, the exchange of the total packets between two IPv4 addresses irrespective the network ports or describe the ...
- 115
1
vote
1
answer
427
views
What is correct iptables chain to put -j NETFLOW
I have a router, with firewall (with drop policy), nats, services.
I want to account all factual traffic (inputed before firewal, outputed by services, and passed firewall in forwarding), with its "...
- 111
1
vote
1
answer
1k
views
MikroTik - Traffic flow (Netflow) Octets Counter wrap
I am using Traffic Flow with pmacct (nfacct) to do IP Accounting.
I've noticed that if a flow exceeds ~4GBytes in less than a minute (which is my active-flow-timeout) the exported flow Octets counter ...
- 2,462
1
vote
1
answer
217
views
source MAC and destination Mac in netflow( or Sflow)
Is any way to see source MAC and destination MAC in netflow(or Sflow) data, like nfdump -r <FILE_NAME> for netflow data. Any best open source(or free) collector for Sflow?
- 313
1
vote
1
answer
930
views
How to configure aws in order to get log events?
My question has two parts:
- How to get log events? The command line tells me that I need to configure aws...
- How to configure aws?
I try to get log events by doing the following:
sudo aws logs ...
- 265
0
votes
1
answer
697
views
Creating High Availability Netflow Collector
I'm currently working on replacing our existing Netflow collector that is EOL with a new one. The goal is to support around 4 million flows/minute and have HA capabilities. Below is my initial thought:...
- 1,393
1
vote
1
answer
2k
views
Installing Samplicator on CentOS
I'm trying to install Samplicator to test Netflow central collector and then forwarding to other collectors from there. I mainly want to use Samplicator due to it being able to easily sample the ...
- 1,393
0
votes
3
answers
1k
views
How to see traffic traversing a Cisco ASA by inside host?
I have a Cisco ASA 5515 running 9.1 and am interested in learning how I can see bandwidth usage by individual hosts. For instance, using MRTG I can see that my average bandwidth utilization is approx ...
- 871
0
votes
0
answers
202
views
What is the Cisco 7200 VXR Netflow Default Sample Rate?
I am trying to collect netflow data from a Cisco 7200 VXR router. I need to specify the sample rate, but I cannot seem to get the information from the cisco router and I do not know what the default ...
- 105
0
votes
1
answer
213
views
CA Network Flow Analysis - sFlow Monitoring Issues
I've been attempting to monitor sFlow traffic from some F5 LTMs, but I'm getting figures like 9 terabytes of data over http, which I don't believe we are getting. Has anyone else had issues like this ...
- 380
0
votes
1
answer
572
views
Does CA Network Flow Analysis Monitor SFlow
Does anyone know if CA Network Flow Analysis can monitor SFlow or receive SFlow packets ?
- 380
2
votes
3
answers
712
views
Syslog to IPFIX
I was reading about logs (syslog) being exported in IPFIX format. And some products which do this as well. What I didn't find, was if there is any standard/known ways of doing this ?. Like if there ...
- 32
-1
votes
2
answers
746
views
Is ntop's sflow support equivalent to netflow?
I've seen conflicting information from various dates and I'm having trouble determining if ntop supports sflow the same way it supports netflow or if it is somehow handicapped and not really worth ...
- 2,753
0
votes
1
answer
289
views
Memory leak in flow_fanout flow_capture. And strange ip in flow_capture output
On my freebsd box:
#uname -rimp
9.1-STABLE amd64 amd64 GENERIC
flow_tools:
> pkg_info -x flow
Information for flow-tools-0.68_7:
Comment:
Suite of tools and library to work with netflow data
...
- 2,250
2
votes
1
answer
189
views
What is the difference between flow-cat and flow-merge?
I am trying to create some monitoring based on flow-tools: I have flow-capture running to log things into directories. Now I need to merge files together for my analysation interval. I have looked at ...
- 586
1
vote
3
answers
691
views
Netflow/IPfix Analyzer for network threats and anomalies
I'm evaluating various options for Netflow/IPfix based analyzers which focus on identifying security threats and anomalies. It would be highly appreciated if someone can provide a list of tools with ...
- 111
1
vote
1
answer
3k
views
Netflow to syslog converter
Is there any way to have netflow v9 converted to syslog?
Which would be the best way to have the following idea working?
Procedure:
The router sends UDP with the following structure:
templateId=259: ...
- 1,657
4
votes
0
answers
547
views
How to support VRF in Netflow Collector?
I am somehow able to analyze netflow packet using my own netflow collector (build in python). It works for certain ip and CIDR(Classless Inter Domain routing), definitely not overlapping. What is the ...
Zangetsu
1
vote
1
answer
2k
views
NetFlow Storage Calculator
I am planning to deploy a NetFlow server (using NfSen/NfDump) for harvesting data from Cisco devices;
Are there standard calculations or guidelines I can use to calculate my server requirements, ...
- 4,212
1
vote
1
answer
2k
views
How come the netflow data isn't showing up on the server?
I have a mikrotik router and it is sending trafficflow (fully compatible with netflow) data to my debian server that is running cacti. But after installing cacti's flowviewer plugin, cacti doesnt ...
- 209
2
votes
1
answer
2k
views
ntop to analyse bandwidth usage on multiple ASA 5505
I have set up a netflow server at our data centre, which is connected via VPN to ~40 remote offices using Cisco ASA 5505. The aim is to analyse usage data and find out exactly how the remote ...
- 9,632
2
votes
2
answers
2k
views
iptables+iptables_netflow: iptables blocking netflow export?
I am running an iptables firewall on OpenSuSE 11.3 --recently I became interested in traffic monitoring and accounting, and to this end installed iptables_netflow module on the firewall and WANGuard ...
- 1,063
20
votes
4
answers
45k
views
How to generate netflow data in linux
We have a number of Linux servers for which I would like to capture netflow data to be processed by a netflow analyzer. I've been spoiled by the ease in which Mikrotik routers allow netflow data ...
- 2,040
2
votes
2
answers
1k
views
How useful is the sysUptime value in a Netflow packet?
The value is in theory precise down to the millisecond, but I am skeptical.
Does that number tell when the packet was transmitted, or when the connection began or ended?
Note: Subsequently I noticed ...
- 21
0
votes
4
answers
2k
views
Netflow packet includes zero port numbers?
What does a zero source port number indicate? Can Netflow tell about something a connection that is not TCP or UDP?
Thanks.
- 21
3
votes
4
answers
1k
views
Can someone explain what NETFLOW. and IPFLOW are?
I hear these terms used a lot but haven't found a decent explanation of what they are, how they are used, and what the data looks like (e.g. can you view this data in wireshark?)?
- 33
2
votes
1
answer
6k
views
NTOP vs NFSEN, which one? [closed]
I want to monitor Cisco's newflows.
Which one of these tools do you recommend?
- 1,341
2
votes
2
answers
2k
views
Problems with getting both ingress and egress Netflow data
I have a Cisco 6500 switch that I want to capture all vlan8 traffic incoming and outgoing. I talked with my networking group and they set me up with the following commands. (May not be exact commands ...
user22492
2
votes
1
answer
2k
views
On RouterOS, how will transparent proxying (with DNAT) affect reporting of netflow?
I have a box running Mikrotik RouterOS, which is set up to do transparent web proxying, as described here.
In short, this means that I have a firewall rule for destination NAT causing any port 80 ...
- 277
2
votes
2
answers
3k
views
On Mikrotik RouterOS, is it possible to get Netflow information from a bridged connection?
I have a RouterOS box set up to bridge two ethernet connections. I have use-ip-firewall=yes in the bridge configuration, so that the ports go through the firewall.
I've enabled netflow reporting via ...
- 277
1
vote
3
answers
880
views
Have NetFlow show true destinations
Currently NetFlow is showing destination (of inbound traffic) as our outside IP rather than inside IP. Also, for all outbound traffic, it is showing the source as our firewall rather than ...
3
votes
6
answers
5k
views
Generating and capturing Netflow on a Linux router
We currently have a dual-NIC Ubuntu server at our data centre acting as the gateway router between our public networks and our ISP. We have a /30 cross connect network on the ISP-facing NIC, and one ...
- 1,221
6
votes
5
answers
40k
views
Monitoring Bandwidth Usage (Per Internal IP) - Cisco ASA 5505
I manage a small network with a Cisco ASA 5505 and a shared DSL connection. I would like to be able monitor the bandwidth usage of the various users/devices on my network (by IP address). Can I do ...
- 1,274
1
vote
1
answer
893
views
Implementing Argus (similar to netflow) what kind of information should I be gathering?
I am setting up a trial of Argus at my company as a diagnostic tool. We have a collector box attached to a monitoring port on our switch, and the initial plan is to redirect ports with unusual traffic ...
- 450
0
votes
1
answer
2k
views
How do I configure NetFlow 5/9 export on Juniper switches? [closed]
What are the commands to make a Juniper switch send netflow data (V5 or V9) to a netflow collector for bandwidth monitoring?
- 61
4
votes
3
answers
10k
views
Can I use Cisco ASA's "NetFlow Security Event Logging" (NetFlow 9) for bandwidth monitoring
Cisco has introduced NetFlow 9 export in the latest software version for ASA firewalls. But it seems to be meant for event logging of security events only (as a replacement for syslog messages).
But ...
- 61