Questions tagged [netflow]

For question about the NetFlow protocol.

Filter by
Sorted by
Tagged with
0
votes
0answers
28 views

NetFlow to determine users on IPTV

tl;dr: I want to know if there is a possibility to determine how many users are streaming from specific IP addresses? I want to know if there is a software which filters NetFlow data from Cisco ...
0
votes
0answers
38 views

Unable to get NetFlow flow in Cisco CSR1000v on AWS

I'm trying to use NetFlow Traffic Analyzer of SolarWinds or any NetFlow Monitor in my Cisco CSR1000v routers which are deployed on AWS. I am unable to see any NetFlow flows in the NetFlow Traffic ...
1
vote
0answers
41 views

Question in netflow statistics [closed]

Hello I'm newbie to network monitoring. I used nfdump -B to filter source port larger than 1024. Then I got 4 fields. In pkt, out pkt, in byte, out bye. Is in mean source to destination or destination ...
0
votes
0answers
29 views

problems in nfdump statistics

i am a newbie to network monitoring. an i tested a nfdump trace file with " nfdump -r -s srcip " then i got the following results. As in the screen shot, what is the different between marked flows ...
0
votes
0answers
31 views

Netflow V9 field Id range

I am confused about the range of field IDs that are supported in netflow v9. I am getting varied data from online sources from 79, 127, 128. I got the above information from (79) - NetFlow v9 has a ...
4
votes
0answers
127 views

Do Juniper MX-series routers support per-interface jFlow/IPFIX sampling rate?

Do Juniper MX-series routers support per-interface jFlow/IPFIX sampling? For example, input sampling rate for xe-0/0/1 is one of 100 and input sampling rate for xe-0/0/2 interface is one of 500. I ...
3
votes
0answers
870 views

NetFlow configuration on Catalyst 4500-X

I have a problem with config NetFlow on 4500-X switch. This is NetFlow config flow record NFArecord match ipv4 tos match ipv4 protocol match ipv4 source address match ipv4 destination address ...
1
vote
1answer
232 views

sflow top talker support

I have nexus 9300 switch and i have configured sflow and i want to find out top-talker IP from command line but i am not seeing any command. I have Cisco ASR1k and i have configured netflow and i ...
1
vote
1answer
45 views

netflow in unknown on my switch

I am using the 3750G catalyst switch and I want to configure netflow but when I put the first command it appears that netflow is unknown: invalid input detected when i'm using netflow
9
votes
1answer
2k views

How does NAT Stitching work?

While reading about CISCO NetFlow Analysis I came up with a term named NAT Stitching. I understand Flow Stitching which join same type of inbound and outbound connection. But can't find anything ...
1
vote
0answers
1k views

Huawei: Configuring netstream

I'm trying to configure NETSTREAM, but I'm a little confused. Following this tutorials: Configuring NetStream export and Huawei: NetStream Configuration. I'm configuring netstream on Huawei Ne20e ...
1
vote
1answer
510 views

Flexible NetFlow Cisco - define input and output?

I am trying to understand the definition of "input" and "output" traffic to an interface. Below is extracted from Flexible NetFlow Documentation in Cisco 3850 -> If you apply a flow monitor in the ...
0
votes
1answer
331 views

PRTG - NetFlow v9 on Cisco ASA 5520 not working [closed]

We have a PRTG Probe 192.168.4.4 in our office's Domain Controller, and we are trying to configure NetFlow on our leased Cisco ASA 5520 ver 8.2(5) We have done the following on the Cisco: conf t ...
1
vote
1answer
1k views

Netflow on Cisco Catalyst 2960X is not sending data to PRTG

I am using 2 Cisco Catalyst 2960X as a stacked switch and I am trying to set up Netflow on them with PRTG as network monitor but it seems that I'm stuck somewhere, below are the config I'm using: ...
2
votes
1answer
431 views

What field tells me the bytes in IPFIX?

In netflow there are in_bytes and in_pkts fields. What are the equivalent values in IPFIX? I'm shipping IPFIX data with softflowd and I'm getting these fields: destinationIPv4Address ...
0
votes
2answers
138 views

Go Back N protocol

I am trying to understand the working of Go-Back N using this website:- http://www.ccs-labs.org/teaching/rn/animations/gbn_sr/ Here, suppose we are sending frames 1,2,3,4,5,6 (window size 4) and in ...
0
votes
1answer
203 views

Best practices for IP Flow monitoring [closed]

Current flow probes (using eg. IPFIX, netFlow v5/9, sFlow) are able to monitor flows defined at least by the tuple < source IP, source Port, IP protocol, destination IP, destination Port, source ...
1
vote
1answer
123 views

What is the expected states of a Cisco Netflow entry if it were collected during different stages of a TCP 3-way handshake?

The standard TCP handshake goes: 1. SYN (client->server) 2. SYN+ACK (server->client) 3. ACK (client->server) The NetFlow flags are ORed together and comprise of: URG ACK ...
2
votes
2answers
2k views

Netflow vs sampled netflow

I'm working on a project where I could need Nexus 5600. These switches support sampled netflow and not netflow. I would like to use netflow to do stats and to analyze trafic at some specific times. ...
2
votes
1answer
178 views

Netflow and Nfsen related question

We had DDoS couple days ago and following is netflow data but i am confused with numbers which i am seeing here. If you look at first Bytes(%) column 67.2 G(80.6) so it's in GB what does this means? ...
0
votes
2answers
79 views

Network report integrated with Active Directory or Users

How can i take network report of bandwidth consumption that integrated with AD or users? I have ASA 5506 and configured netflow 9 with PRTG, I can see the source IP and Destination IPs, Is there any ...
0
votes
1answer
327 views

What does limit a MTU set for an interface? [closed]

The maximum MTU I can set is between 9000 an 10,000 for a Ethernet interface. I have the following message for high values ifconfig eth0 mtu 10000 SIOCSIFMTU: Invalid argument What is the origin ...
2
votes
2answers
283 views

Sampled Netflow

i have configured netflow in my router but my router is overheaded. So i decided to configure sampled netflow and sampling rate of 1 out of 100 packets may reduce the export if Netflow data by as ...
0
votes
1answer
128 views

resolving IP address to FQDN effectively [closed]

We use Netflow to control traffic, when i want to resolve the IP addresses from netflow's outside destinations list, i get local google cache server's IP address, never the web sites that users has ...
1
vote
1answer
134 views

NetFlow working for physical/sub interfaces only?

As far as I know, NetFlow can collect data from physical interfaces and its subinterfaces, right? Not from loopback, VLAN, tunnel or any virtual interface.
2
votes
1answer
956 views

Not receiving netflow v9, v5 works - Juniper SRX

We have an ELK Stack running that gathers data and processes it to the point where end users can visualize the data. Right now we're dealing with Syslogs and Netflow, but are experiencing some issues ...
1
vote
1answer
1k views

Cisco netflow with nfsen/nfdump

We have Cisco ASR1000 Router and it has following configuration: flow record netflow-record match transport tcp destination-port match transport tcp source-port match transport udp ...
1
vote
1answer
93 views

Where does Netflow get Written to?

I have Netflow V9 being sent to a server running Ubuntu 14.04. The data is communicated on port 2000 (the default for Netflow). However nothing appears to be listening on that port. (nothing shows ...
1
vote
1answer
87 views

sniffing through my company's lan [closed]

I'm in charge of the network in my company and i have to check the visited websites.We have a edgeMAX router (firmware version 1.8) with DPI and enabling netflow exporting.DPI (as is it implemented in ...
1
vote
1answer
2k views

NetFlow v9 on Cisco Catalyst 3560 not working

my team and I just don't seem to get NetFlow on a Catalyst 3560 switch to work. let me show you the config: flow exporter NETFLOW-EXPORTER destination 10.10.10.12 source Vlan100 transport udp ...
2
votes
3answers
1k views

What is a common setting for NetFlow Active Flow Timeout?

What is a common/best practice value for 'active flow time-out' for flow generation from packets. With 'active flow time-out' I refer to the time limit when the current flow (src ip,dest ip, src ...
4
votes
1answer
233 views

Set of features to characterize DDoS from Netflow data [closed]

I am currently working on a DDoS detection problem from Netflow data from an ISP’s perspective. Very large datasets are available to me for analysis. Though I have done considerable amount of work, ...
2
votes
1answer
275 views

The router exports IPFIX data and templates from two different source id

I configure Netflow Flexible use IPFIX protocol on a Cisco router and receive IPFIX packet from it successfully. The router exports data-sets with an exporter (source id = 0) and template-sets with ...
3
votes
2answers
546 views

NetFlow-working one direction only

Cisco 3850/IP Base/IOS XE 3.7.2 I was going over my NetFlow data, and it seemed I was only catching flow in, and not out. I already had the in/out records and monitors, using the same exporter to one ...
3
votes
2answers
299 views

Can multiple netflow exporters use same collector port name?

As per my knowledge, each exporter(Netflow packets from server1, Netflow packets from server2...) have a destination collector port(single nfcap daemon). So, is there any way to configure multiple ...
2
votes
1answer
107 views

Cisco top-talker data

I have enabled top-talkers ingress/egress ip flow-top-talkers top 10 sort-by bytes cache-timeout 1 I wanted to confirm a couple things with the output below 1.) When I see a (K), I assume its ...
1
vote
1answer
522 views

cisco flow vs ip flow

Using a 2900 series router and I encounter the following issue: hostname#show flow monitor Flow Monitor TESTFLOW: Description: User defined Flow Record: TESTFLOW Flow Exporter: ...
1
vote
1answer
795 views

My ASA has decided to stop sending NetFlow traffic. Is there a way to fix this short of restarting?

I have been running NetFlow successfully on all of my ASAs for the past few months. Recently, one of my ASA failover pairs has decided to stop sending netflow packets. Is there a command to restart ...
5
votes
1answer
338 views

Mechanisn for performing bandwidth accounting on Cisco routers

We're about to purchase a pair of Cisco 7201s for our edge routers, and some Juniper EX4200s for core. And I'm looking for implement bandwidth accounting for our hosted servers on this hardware (most ...
7
votes
1answer
3k views

How to get ipfix working with openvswitch? [closed]

I'm trying to monitor my OpenVswitch via IPFix. But I'm banging my head against a brick wall for two days now :/ According to the ovs-vsctl manpage I need to add a new entry into the config-database, ...
2
votes
1answer
182 views

Is there ever a scenario where there would be a 0 length response to an ECHO?

I'm attempting to utilize the flow probe argus to determine "node liveliness"/reachability. I am currently working on handling ICMP status, but would like to derive a method to determine if a ping "...
12
votes
1answer
1k views

What is the “NDE” interface on a Cisco 6500?

I have a pair of Cisco 6509 routers, which are monitored via SNMP (with Observium, to be accurate). Today we spotted a peak of CPU usage for a Switching Processor. The peak can be correlated with a ...
2
votes
0answers
94 views

NDE for QoS Flows on SUP720-3C?

I've setup per user Layer 2 policing on a pair of Cat6k with SUP720-3C to rate-limit wireless guest users. This is working fine and the flow table is populated as expected (with L2 QoS flows). Now my ...
22
votes
4answers
60k views

What is the difference between netFlow and sFlow?

How is sFlow different from netFlow, and how is each supported by different vendors ?
5
votes
5answers
761 views

Can netflow be left on all the time?

One of my colleagues and I have gotten into a debate about netflow. He's an old Cisco hand and I've recently joined the cisco ops team after working on Juniper for a few years. The debate is whether ...
9
votes
3answers
933 views

ASA Netflow support

Cisco ASAs support a version of netflow called NetFlow Secure Event Logging (NSEL). Is special support for the protocol required on the collectors to view the flows? Is the protocol compatible with ...