Questions tagged [netflow]

For question about the NetFlow protocol.

Filter by
Sorted by
Tagged with
0
votes
0answers
20 views

separate traffic by destination ip address as ISP [closed]

As ISP, I want separate traffic and tag packets by destination ip address and then send to accounting software then set traffic to free or lower cost. I have multiple Mikrotik radio so i'll send IPFIX ...
1
vote
1answer
282 views

Configure jflow v5 get error: interface-name: 'xxx': Must be a services interface

friends: When I configure the jflow v5 on my MX-480: ===== admin@USA-MX-RE0# show forwarding-options sampling instance { MONITOR-FLOW { input { rate 1000; } ...
0
votes
0answers
37 views

read traffic/bandwidth usage by protocol

I need to analyze the traffic of a Fortigate Firewall in my program. Currently, I can read the overall traffic using SNMP. The problem is that I need to analyze the type of traffic (HTTP, video ...
2
votes
1answer
43 views

What is Netflow Scope field?

I was looking at RFC3954, RFC7011 and some Cisco docs - however I can't find the answer for what is the Scope field is? What information does it carry?
2
votes
2answers
76 views

Why is Wireshark unhappy with my Netflow packet sequence numbers?

I wrote a Netflow v10 (IPFIX) traffic generator. It spoofs Source IP addresses to pretend to be coming from multiple sites, and has fake users it sends reports about. The idea is very similar to ...
0
votes
0answers
66 views

How to configure the jflow correctly in my juniper router?

I configured the jFlow sampling in Juniper MX480: but in my receive data server, there is no data received: and when I use Paessler Netflow Tester test it, there cannot use 14.224.224.253: Whether ...
0
votes
0answers
44 views

Cisco C3750 and PRTG netfllow

I have a core switch (backbone) of our network that broadcasts all the vlans to other switches. I am trying to configure netflow on the switch and link it up to a Netflow sensor on PRTG. I followed ...
1
vote
1answer
104 views

How is start and end time of a flow encoded in Netflow (v9)?

I'm trying to convert AWS VPC Flow Logs into Netflow v9. Each VPC Flow Log record has start and end timestamps that I'd like to encode in a Netflow data record. Looking at the Netflow v9 spec, there ...
0
votes
0answers
110 views

Unable to get NetFlow flow in Cisco CSR1000v on AWS

I'm trying to use NetFlow Traffic Analyzer of SolarWinds or any NetFlow Monitor in my Cisco CSR1000v routers which are deployed on AWS. I am unable to see any NetFlow flows in the NetFlow Traffic ...
0
votes
0answers
64 views

Netflow V9 field Id range

I am confused about the range of field IDs that are supported in netflow v9. I am getting varied data from online sources from 79, 127, 128. I got the above information from (79) - NetFlow v9 has a ...
4
votes
0answers
242 views

Do Juniper MX-series routers support per-interface jFlow/IPFIX sampling rate?

Do Juniper MX-series routers support per-interface jFlow/IPFIX sampling? For example, input sampling rate for xe-0/0/1 is one of 100 and input sampling rate for xe-0/0/2 interface is one of 500. I ...
3
votes
1answer
1k views

NetFlow configuration on Catalyst 4500-X

I have a problem with config NetFlow on 4500-X switch. This is NetFlow config flow record NFArecord match ipv4 tos match ipv4 protocol match ipv4 source address match ipv4 destination address ...
1
vote
1answer
373 views

sflow top talker support

I have nexus 9300 switch and i have configured sflow and i want to find out top-talker IP from command line but i am not seeing any command. I have Cisco ASR1k and i have configured netflow and i ...
1
vote
1answer
53 views

netflow in unknown on my switch

I am using the 3750G catalyst switch and I want to configure netflow but when I put the first command it appears that netflow is unknown: invalid input detected when i'm using netflow
9
votes
1answer
2k views

How does NAT Stitching work?

While reading about CISCO NetFlow Analysis I came up with a term named NAT Stitching. I understand Flow Stitching which join same type of inbound and outbound connection. But can't find anything ...
1
vote
0answers
1k views

Huawei: Configuring netstream

I'm trying to configure NETSTREAM, but I'm a little confused. Following this tutorials: Configuring NetStream export and Huawei: NetStream Configuration. I'm configuring netstream on Huawei Ne20e ...
1
vote
1answer
809 views

Flexible NetFlow Cisco - define input and output?

I am trying to understand the definition of "input" and "output" traffic to an interface. Below is extracted from Flexible NetFlow Documentation in Cisco 3850 -> If you apply a flow monitor in the ...
0
votes
1answer
423 views

PRTG - NetFlow v9 on Cisco ASA 5520 not working [closed]

We have a PRTG Probe 192.168.4.4 in our office's Domain Controller, and we are trying to configure NetFlow on our leased Cisco ASA 5520 ver 8.2(5) We have done the following on the Cisco: conf t ...
1
vote
1answer
2k views

Netflow on Cisco Catalyst 2960X is not sending data to PRTG

I am using 2 Cisco Catalyst 2960X as a stacked switch and I am trying to set up Netflow on them with PRTG as network monitor but it seems that I'm stuck somewhere, below are the config I'm using: ...
2
votes
1answer
591 views

What field tells me the bytes in IPFIX?

In netflow there are in_bytes and in_pkts fields. What are the equivalent values in IPFIX? I'm shipping IPFIX data with softflowd and I'm getting these fields: destinationIPv4Address ...
0
votes
2answers
285 views

Go Back N protocol

I am trying to understand the working of Go-Back N using this website:- http://www.ccs-labs.org/teaching/rn/animations/gbn_sr/ Here, suppose we are sending frames 1,2,3,4,5,6 (window size 4) and in ...
0
votes
1answer
225 views

Best practices for IP Flow monitoring [closed]

Current flow probes (using eg. IPFIX, netFlow v5/9, sFlow) are able to monitor flows defined at least by the tuple < source IP, source Port, IP protocol, destination IP, destination Port, source ...
1
vote
1answer
176 views

What is the expected states of a Cisco Netflow entry if it were collected during different stages of a TCP 3-way handshake?

The standard TCP handshake goes: 1. SYN (client->server) 2. SYN+ACK (server->client) 3. ACK (client->server) The NetFlow flags are ORed together and comprise of: URG ACK ...
2
votes
2answers
3k views

Netflow vs sampled netflow

I'm working on a project where I could need Nexus 5600. These switches support sampled netflow and not netflow. I would like to use netflow to do stats and to analyze trafic at some specific times. ...
2
votes
1answer
205 views

Netflow and Nfsen related question

We had DDoS couple days ago and following is netflow data but i am confused with numbers which i am seeing here. If you look at first Bytes(%) column 67.2 G(80.6) so it's in GB what does this means? ...
0
votes
2answers
80 views

Network report integrated with Active Directory or Users

How can i take network report of bandwidth consumption that integrated with AD or users? I have ASA 5506 and configured netflow 9 with PRTG, I can see the source IP and Destination IPs, Is there any ...
0
votes
1answer
513 views

What does limit a MTU set for an interface? [closed]

The maximum MTU I can set is between 9000 an 10,000 for a Ethernet interface. I have the following message for high values ifconfig eth0 mtu 10000 SIOCSIFMTU: Invalid argument What is the origin ...
2
votes
2answers
339 views

Sampled Netflow

i have configured netflow in my router but my router is overheaded. So i decided to configure sampled netflow and sampling rate of 1 out of 100 packets may reduce the export if Netflow data by as ...
0
votes
1answer
145 views

resolving IP address to FQDN effectively [closed]

We use Netflow to control traffic, when i want to resolve the IP addresses from netflow's outside destinations list, i get local google cache server's IP address, never the web sites that users has ...
1
vote
1answer
147 views

NetFlow working for physical/sub interfaces only?

As far as I know, NetFlow can collect data from physical interfaces and its subinterfaces, right? Not from loopback, VLAN, tunnel or any virtual interface.
2
votes
1answer
1k views

Not receiving netflow v9, v5 works - Juniper SRX

We have an ELK Stack running that gathers data and processes it to the point where end users can visualize the data. Right now we're dealing with Syslogs and Netflow, but are experiencing some issues ...
1
vote
1answer
1k views

Cisco netflow with nfsen/nfdump

We have Cisco ASR1000 Router and it has following configuration: flow record netflow-record match transport tcp destination-port match transport tcp source-port match transport udp ...
1
vote
1answer
101 views

Where does Netflow get Written to?

I have Netflow V9 being sent to a server running Ubuntu 14.04. The data is communicated on port 2000 (the default for Netflow). However nothing appears to be listening on that port. (nothing shows ...
1
vote
1answer
87 views

sniffing through my company's lan [closed]

I'm in charge of the network in my company and i have to check the visited websites.We have a edgeMAX router (firmware version 1.8) with DPI and enabling netflow exporting.DPI (as is it implemented in ...
1
vote
1answer
3k views

NetFlow v9 on Cisco Catalyst 3560 not working

my team and I just don't seem to get NetFlow on a Catalyst 3560 switch to work. let me show you the config: flow exporter NETFLOW-EXPORTER destination 10.10.10.12 source Vlan100 transport udp ...
2
votes
3answers
2k views

What is a common setting for NetFlow Active Flow Timeout?

What is a common/best practice value for 'active flow time-out' for flow generation from packets. With 'active flow time-out' I refer to the time limit when the current flow (src ip,dest ip, src ...
4
votes
1answer
254 views

Set of features to characterize DDoS from Netflow data [closed]

I am currently working on a DDoS detection problem from Netflow data from an ISP’s perspective. Very large datasets are available to me for analysis. Though I have done considerable amount of work, ...
2
votes
1answer
297 views

The router exports IPFIX data and templates from two different source id

I configure Netflow Flexible use IPFIX protocol on a Cisco router and receive IPFIX packet from it successfully. The router exports data-sets with an exporter (source id = 0) and template-sets with ...
3
votes
2answers
706 views

NetFlow-working one direction only

Cisco 3850/IP Base/IOS XE 3.7.2 I was going over my NetFlow data, and it seemed I was only catching flow in, and not out. I already had the in/out records and monitors, using the same exporter to one ...
3
votes
2answers
358 views

Can multiple netflow exporters use same collector port name?

As per my knowledge, each exporter(Netflow packets from server1, Netflow packets from server2...) have a destination collector port(single nfcap daemon). So, is there any way to configure multiple ...
2
votes
1answer
119 views

Cisco top-talker data

I have enabled top-talkers ingress/egress ip flow-top-talkers top 10 sort-by bytes cache-timeout 1 I wanted to confirm a couple things with the output below 1.) When I see a (K), I assume its ...
1
vote
1answer
550 views

cisco flow vs ip flow

Using a 2900 series router and I encounter the following issue: hostname#show flow monitor Flow Monitor TESTFLOW: Description: User defined Flow Record: TESTFLOW Flow Exporter: ...
1
vote
1answer
936 views

My ASA has decided to stop sending NetFlow traffic. Is there a way to fix this short of restarting?

I have been running NetFlow successfully on all of my ASAs for the past few months. Recently, one of my ASA failover pairs has decided to stop sending netflow packets. Is there a command to restart ...
5
votes
1answer
348 views

Mechanisn for performing bandwidth accounting on Cisco routers

We're about to purchase a pair of Cisco 7201s for our edge routers, and some Juniper EX4200s for core. And I'm looking for implement bandwidth accounting for our hosted servers on this hardware (most ...
7
votes
1answer
3k views

How to get ipfix working with openvswitch? [closed]

I'm trying to monitor my OpenVswitch via IPFix. But I'm banging my head against a brick wall for two days now :/ According to the ovs-vsctl manpage I need to add a new entry into the config-database, ...
2
votes
1answer
185 views

Is there ever a scenario where there would be a 0 length response to an ECHO?

I'm attempting to utilize the flow probe argus to determine "node liveliness"/reachability. I am currently working on handling ICMP status, but would like to derive a method to determine if a ping "...
12
votes
1answer
1k views

What is the “NDE” interface on a Cisco 6500?

I have a pair of Cisco 6509 routers, which are monitored via SNMP (with Observium, to be accurate). Today we spotted a peak of CPU usage for a Switching Processor. The peak can be correlated with a ...
2
votes
0answers
96 views

NDE for QoS Flows on SUP720-3C?

I've setup per user Layer 2 policing on a pair of Cat6k with SUP720-3C to rate-limit wireless guest users. This is working fine and the flow table is populated as expected (with L2 QoS flows). Now my ...
22
votes
4answers
66k views

What is the difference between netFlow and sFlow?

How is sFlow different from netFlow, and how is each supported by different vendors ?
5
votes
5answers
821 views

Can netflow be left on all the time?

One of my colleagues and I have gotten into a debate about netflow. He's an old Cisco hand and I've recently joined the cisco ops team after working on Juniper for a few years. The debate is whether ...