We are using NetFlow 4.1.1 and trying to see if we can accomplish 2 things:

1) Alert on if a specific country shows up on the list

2) Create a report f countries

I have not been able to accomplish either and I have been trying to "think outside the box" using crazy SQL queries, etc.

Hi have been trying to work with Cisco over the past 4 weeks to get Flexible Netflow to work properly with Orion/NTA with zero success. This is a 4507R+E with dual Sup 7's

I have the works TAC support person, but that's beside the point. I've spoken with SW and didn't get the warm and fuzzies on their answers either.

It appears to me I will not be able to monitor layre "virtual" interfaces on the 4507, which is unacceptable and if the case I will raise a stink with Cisco one I get it working.

So my questions are:

Does it even work? This hardware, Flexible Network and NTA 3.7?

The commands take and it just seems like NTA doesn't accept them, I'm guessing they are missing something like TOS, but this is not the same as regular Netflow.

I have been testing many permitations, but I either get the traffic in NTA showing that it is coming from all interfaces, or it doesn't see any at all.

 Here's the config I am testing with today:

flow record ipv4
! match ipv4 tos
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
collect interface input
!
!
flow exporter NetFlow-to-Orion
 destination 10.10.10.1
 source vlan254
 transport udp 2055
export-protocol netflow-v5
!
!
flow monitor NetFlow-Monitor
 description Original Netflow captures
 record ipv4
 exporter NetFlow-to-Orion

vlan configuration 254
ip flow monitor NetFlow-Monitor input

Any help would be great

Bob

Hi,

I keep getting the following error when a scheduled backup of the NTA DB: An error occurred during the backup on , error message: The given key was not present in the dictionary

I have checked to make sure there is adequate disk space as well as ran DB maintenance. Has anyone else experienced this issue?

thanks

We are successfully using NTA 4.1.0 with other data sources and have now configured our Cisco 5508 Wireless Controllers to export NetFlow to NTA and are seeing the following error:

The WCS controllers are running software version 7.6.120.0

Is there any solution to this or do I need to make a feature request to support NetFlow in NTA from Cisco Wireless

Hi, I would like to ask if all traffic flows on a interface can be exported (i.e. xls, csv, raw) or viewed from GUI?

I believe currently now we can only view a conversation flow from 1 IP address to another.

Hello Everyone...Newbie here,

We want to setup our SolarWinds Netflow Anaylzer 4.1.1 to work with Cisco Catalyst 4510 Supervisor 8-e and so far SW tech support hasn't been able to assist me.

They sent me some document that shows a config setup with Supervisor 7-e, but no luck.  We even called Cisco tech support and they said this is a Solarwinds issue with their template.

Does anyone have any experience or ideas on how to make this work?

-Harold

I am attempting to set up NetFlow on a variety of Cisco equipment and I keep hitting a wall.

Apparently the following Cisco equipment does not support NetFlow - Nexus 6K, 5K, 3750,

3850 and possibly 3845 routers.

Our environment consists primarily of those devices.  Is NetFlow supported by those device

types?   If so how do I proceed and configure that gear?

I was able to get Netflow to pull from our distribution switch.  Which is a Cisco 6506-E in VSS configuration. Then that ties into a Cisco Core VSS block which is 6504-E.  We have a lot of Layer 2 and Layer 3 links coming to the Distribution switch.

So I have the following commands on the distribution switch.

flow record ipv4

match ipv4 protocol

match ipv4 source address

match ipv4 destination address

match transport source-port

match transport destination-port

match interface input

collect interface output

collect counter bytes

collect counter packets

!

!

flow exporter NetFlow-to-Orion

destination 172.18.2.107

source Loopback0

transport udp 2055

export-protocol netflow-v5

!

flow platform cache timeout fast

!

flow monitor NetFlow-Monitor

description Original Netflow Captures

record ipv4

exporter NetFlow-to-Orion

cache timeout inactive 10

cache timeout active 5

!

flow hardware export threshold 70 linecard 90

So I have all the layer 3 port channel and vlan interfaces configured with

ip flow monitor NetFlow-Monitor input

ip flow monitor NetFlow-Monitor output

I get netflow data, but I want to make sure this would be good enough to get accurate netflow data for our environment.  Example, we got a layer 3 switch on 8th floor going to the distribution switch.  The switch on 8th floor isn't setup for netflow since its a 3750v2 and I do not believe that switch supports netflow, but the link on the distribution switch that points back to that switch is.  So will that be good enough to capture data for that area on 8th floor? does netflow have to capture from both sides or is gathering data from the distribution side good enough?

appreciate the help!

NTA reports egress traffic on, let's say interface g0/0, that, in every instance, exceeds that traffic shaping that has been applied to that interface. For example: at one site, it shows peak egress traffic at 8Mbps or so peak, but that interface has an egress shaping policy applied to it with a max of 1.5Mbps. how is that possible? same scenario, an interface with shaping for 20Mbps shows 40 and sometimes 60Mbps egress, yet the policy map shows very few packets dropped. Any ideas?

Is there a way to make the Neflow Traffic Analyzer show the actual port number when viewing conversations instead of "Random High Port"?  I need to be able to track exactly what port a conversation is coming from.   Thanks!

Hi!

I have close to 40 sites with multiple IP ranges at each site. Does anyone know if there is a way to import this data to configure the IP Address Groups in NTA so I  do not need to manually enter 150+ IP ranges into the NTA configuration?

Thanks in advance for any help!

James

I'm a network guy who is coming into an established environment tasked with getting more useful data out of the current Netflow. I would like to understand the output of what is highlighted below before I get too carried away with configuring more equipment to push flow. Please forgive my lack of knowledge on the DB side of the house but I can't really find a reason as to why I am getting this output. After talking with coworkers I understand that all of the defaults were accepted during setup and that the server where this database is located at is only used for netflow. Let me know what you think. Thanks.

NTA Version: 4.1.1

I am coming into a Solarwinds environment and trying to understand how everything fits together. We have our main poller, Orian DB, Netflow DB in one city and our secondary poller in another city. Our main poller was at 98% polling rate. I moved a group of firewalls to the other poller to even things out. I was approached by a team member that said the poller being used needs to be in the same network as the netflow db. I've tried to read over some documentation, but i cant find a source to prove or disprove them.

The NTA and the Pollers are separate entities, right? Cant i point my firewalls to our main poller for NTA and use our secondary poller to poll?

So I am curious how the solarwinds netflow collector interprets and graphs the data collected.

More specifically does the graph that solarwinds generates to represent Mbps over time take into consideration the duration of the flow?

For instance this graph above caused some alarm for us today. Digging into the data it appeared that 4 web servers moved over 40Gigs of data to a SQL database.

Looking at the server I/O, the jobs running, and the interfaces that the servers and the DB are connected to we could not account for anywhere close to this amount of data.

Looking at the firewall logs at this time I found about 30 flows that all closed around 2:38pm which is the same time on the graph that we see the spike.

Each of the closed flows had moved over 1gig of data however they also all had a duration of about 24 hours.

And yes we have some custom in house apps that required us to lift the limit in the firewall for the flow duration. I am not happy about it but it's not something I can control.

So my real question is does solarwinds take into account the flow duration and average that data out over the time to graph the flow?

For instance if a flow moved 45 Gigabytes of data in 1 hour then if the graph was 10 minute resolutions you would get a square wave with all 10 data points being at roughly 100Mbps?

Or does it just look at the close time and the total bytes transferred and graph that as a single point? So in the example I gave it would be just a single spike at the end of the flow at 45Gbps.

Based on what I have seen I am leaning toward the later, but I just thought I would reach out to Thwack to see if someone can confirm this behavior.

Any help on this would be greatly appreciated.

I have my Gaia based checkpoint firewall sending netflow data to NTA just fine - but it seems it's only sending my Hide NAT address and no internal IP data. Is that something I misconfigured, can fix, can otherwise address? I would like to see network top talkers, etc but can only get to my public IP level which isn't all that helpful. Thanks!!

Problem

I was looking for an alternative to NProbe as a NetFlow Probe/Agent for a CentOS as NProbe is not free and i wanted somehing that i could run as a Probe only and in deamon mode.  After looking at various options, I settled on SoftFlowD as an alternative and thought that I would share with the community how exactly I did it.  It works like a dream for me so enjoy!!!

Installing SoftFlowD as a TCP Flow Based Probe

The following is a description of how we can install a TCP Flow based probe to capture the data going in and out of a Centos Linux server and to export this in NetFlow Version 5 format to a collector for further analysis.

First of ak, we need to ensure that we have a few utilities installed on the server to satisfy the dependencies.

[root@wbcphpxy01 ~]# yum install libtool automake autoconf python-devel

libpcap-devel

Once these are installed, then let’s get a copy of the softflowd compressed source files:-

[root@wbcphpxy01 ~]# cd /root

[root@wbcphpxy01 ~]#wget http://softflowd.googlecode.com/files/softflowd-0.9.9.tar.gz

--2013-09-30 11:17:13--  http://softflowd.googlecode.com/files/softflowd-0.9.9.tar.gz

Resolving softflowd.googlecode.com... 173.194.70.82, 2a00:1450:4001:c02::52

Connecting to softflowd.googlecode.com|173.194.70.82|:80... connected.

HTTP request sent, awaiting response... 200 OK

Length: 91939 (90K) [application/x-gzip]

Saving to: âsoftflowd-0.9.9.tar.gzâ

100%[======================================>] 91,939      --.-K/s   in 0.1s

2013-09-30 11:17:13 (673 KB/s) - âsoftflowd-0.9.9.tar.gzâ

Now let’s decompress them:-

[root@wbcphpxy01 ~]# tar -zxvf softflowd-0.9.9.tar.gz

softflowd-0.9.9

softflowd-0.9.9/softflowctl.8

softflowd-0.9.9/.hg_archival.txt

softflowd-0.9.9/.cvsignore

softflowd-0.9.9/.hgtags

softflowd-0.9.9/LICENSE

softflowd-0.9.9/Makefile.in

softflowd-0.9.9/README

softflowd-0.9.9/TODO

softflowd-0.9.9/aclocal.m4

softflowd-0.9.9/closefrom.c

softflowd-0.9.9/collector.pl

softflowd-0.9.9/common.h

softflowd-0.9.9/configure.ac

softflowd-0.9.9/convtime.c

softflowd-0.9.9/convtime.h

softflowd-0.9.9/daemon.c

softflowd-0.9.9/freelist.c

softflowd-0.9.9/freelist.h

softflowd-0.9.9/install-sh

softflowd-0.9.9/log.c

softflowd-0.9.9/log.h

softflowd-0.9.9/mkinstalldirs

softflowd-0.9.9/netflow1.c

softflowd-0.9.9/netflow5.c

softflowd-0.9.9/netflow9.c

softflowd-0.9.9/softflowd.sysconfig

softflowd-0.9.9/softflowctl.c

softflowd-0.9.9/softflowd.8

softflowd-0.9.9/softflowd.c

softflowd-0.9.9/softflowd.h

softflowd-0.9.9/softflowd.init

softflowd-0.9.9/softflowd.spec

softflowd-0.9.9/strlcat.c

softflowd-0.9.9/strlcpy.c

softflowd-0.9.9/sys-tree.h

softflowd-0.9.9/treetype.h

softflowd-0.9.9/configure

softflowd-0.9.9/config.h.in

Now that we have uncompressed the files, let’s change to the relevant directory and then run the configuration script that checks whether you have the relevant programs dependencies such as gcc in place and where those binaries are on your system:-

[root@wbcphpxy01 ~]# cd softflowd-0.9.9

[root@wbcphpxy01 softflowd-0.9.9]# ./configure

checking for gcc... gcc

checking whether the C compiler works... yes

checking for C compiler default output file name... a.out

checking for suffix of executables...

checking whether we are cross compiling... no

checking for suffix of object files... o

checking whether we are using the GNU C compiler... yes

checking whether gcc accepts -g... yes

checking for gcc option to accept ISO C89... none needed

checking for a BSD-compatible install... /usr/bin/install -c

checking how to run the C preprocessor... gcc -E

checking for grep that handles long lines and -e... /bin/grep

checking for egrep... /bin/grep -E

checking for ANSI C header files... yes

checking for sys/types.h... yes

checking for sys/stat.h... yes

checking for stdlib.h... yes

checking for string.h... yes

checking for memory.h... yes

checking for strings.h... yes

checking for inttypes.h... yes

checking for stdint.h... yes

checking for unistd.h... yes

checking net/bpf.h usability... no

checking net/bpf.h presence... no

checking for net/bpf.h... no

checking pcap.h usability... yes

checking pcap.h presence... yes

checking for pcap.h... yes

checking pcap-bpf.h usability... yes

checking pcap-bpf.h presence... yes

checking for pcap-bpf.h... yes

checking for struct sockaddr.sa_len... no

checking for struct ip6_ext.ip6e_nxt... yes

checking for library containing daemon... none required

checking for library containing gethostbyname... none required

checking for library containing socket... none required

checking for pcap_open_live in -lpcap... yes

checking for closefrom... no

checking for daemon... yes

checking for setresuid... yes

checking for setreuid... yes

checking for setresgid... yes

checking for setgid... yes

checking for strlcpy... no

checking for strlcat... no

checking for u_int64_t... yes

checking for int64_t... yes

checking for uint64_t... yes

checking for u_int32_t... yes

checking for int32_t... yes

checking for uint32_t... yes

checking for u_int16_t... yes

checking for int16_t... yes

checking for uint16_t... yes

checking for u_int8_t... yes

checking for int8_t... yes

checking for uint8_t... yes

checking size of char... 1

checking size of short int... 2

checking size of int... 4

checking size of long int... 4

checking size of long long int... 8

configure: creating ./config.status

1. config.status: creating Makefile
2. config.status: WARNING:  'Makefile.in' seems to ignore the --datarootdir setting
3. config.status: creating config.h

Now we need to run the make utility to build a binary executable ready to install, which is customised to your environment:-

[root@wbcphpxy01 softflowd-0.9.9]# make

gcc -g -O2 -DFLOW_SPLAY          -DEXPIRY_RB             -I.   -c -o softflowd.o softflowd.c

gcc -g -O2 -DFLOW_SPLAY          -DEXPIRY_RB             -I.   -c -o log.o log.c

gcc -g -O2 -DFLOW_SPLAY          -DEXPIRY_RB             -I.   -c -o netflow1.o netflow1.c

gcc -g -O2 -DFLOW_SPLAY          -DEXPIRY_RB             -I.   -c -o netflow5.o netflow5.c

gcc -g -O2 -DFLOW_SPLAY          -DEXPIRY_RB             -I.   -c -o netflow9.o netflow9.c

gcc -g -O2 -DFLOW_SPLAY          -DEXPIRY_RB             -I.   -c -o freelist.o freelist.c

gcc -g -O2 -DFLOW_SPLAY          -DEXPIRY_RB             -I.   -c -o convtime.o convtime.c

gcc -g -O2 -DFLOW_SPLAY          -DEXPIRY_RB             -I.   -c -o strlcpy.o strlcpy.c

gcc -g -O2 -DFLOW_SPLAY          -DEXPIRY_RB             -I.   -c -o strlcat.o strlcat.c

gcc -g -O2 -DFLOW_SPLAY          -DEXPIRY_RB             -I.   -c -o closefrom.o closefrom.c

gcc -g -O2 -DFLOW_SPLAY          -DEXPIRY_RB             -I.   -c -o daemon.o daemon.c

gcc  -o softflowd softflowd.o log.o netflow1.o netflow5.o netflow9.o freelist.o convtime.o strlcpy.o strlcat.o closefrom.o daemon.o -lpcap

gcc -g -O2 -DFLOW_SPLAY          -DEXPIRY_RB             -I.   -c -o softflowctl.o softflowctl.c

gcc  -o softflowctl softflowctl.o convtime.o strlcpy.o strlcat.o closefrom.o daemon.o -lpcap

Now that we have a binary ready for installing, we just need to install the application on your system:-

[root@wbcphpxy01 softflowd-0.9.9]# make install

[ -d /usr/local/sbin ] || \./mkinstalldirs /usr/local/sbin

[ -d /usr/local/share/man/man8 ] || \./mkinstalldirs /usr/local/share/man/man8

/usr/bin/install -c -m 0755 -s softflowd /usr/local/sbin/softflowd

/usr/bin/install -c -m 0755 -s softflowctl /usr/local/sbin/softflowctl

/usr/bin/install -c -m 0644 softflowd.8 /usr/local/share/man/man8/softflowd.8

/usr/bin/install -c -m 0644 softflowctl.8 /usr/local/share/man/man8/softflowctl.8

[root@wbcphpxy01 softflowd-0.9.9]#

Now that we have a working copy of softflowd on the system, we can review the help file for the application by typing the following:-

[root@wbcphpxy01 ~]# softflowd -h

-i or -r option not specified.

Usage: softflowd [options] [bpf_program]

This is softflowd version 0.9.9. Valid commandline options:

  -i [idx:]interface Specify interface to listen on

  -r pcap_file       Specify packet capture file to read

  -t timeout=time    Specify named timeout

  -m max_flows       Specify maximum number of flows to track (default 8192)

  -n host:port       Send Cisco NetFlow(tm)-compatible packets to host:port

  -p pidfile         Record pid in specified file

                     (default: /var/run/softflowd.pid)

  -c pidfile         Location of control socket

                     (default: /var/run/softflowd.ctl)

  -v 1|5|9           NetFlow export packet version

  -L hoplimit        Set TTL/hoplimit for export datagrams

  -T full|proto|ip   Set flow tracking level (default: full)

  -6                 Track IPv6 flows, regardless of whether selected

                     NetFlow export protocol supports it

  -d                 Don't daemonise (run in foreground)

  -D                 Debug mode: foreground + verbosity + track v6 flows

  -s sampling_rate   Specify periodical sampling rate (denominator)

  -h                 Display this help

Now, we should be able to run the software in Debug mode in the foreground using the following command to ensure that we see the relevant messages (especially error messages):-

[root@wbcphpxy01 ~]# softflowd -D -v 5 -i eth0 -n 10.20.30.15:2055 -T full

Using eth0 (idx: 0)

softflowd v0.9.9 starting data collection

Exporting flows to [10.20.30.15]:iop

ADD FLOW seq:1 [10.170.1.201]:1335 <> [10.170.5.251]:22 proto:6

ADD FLOW seq:2 [10.140.42.250]:58374 <> [239.255.255.250]:1900 proto:17

ADD FLOW seq:3 [10.170.5.101]:0 <> [224.0.0.252]:0 proto:2

ADD FLOW seq:4 [10.170.5.101]:0 <> [239.255.255.250]:0 proto:2

...

In the above example, the following explains each of the switches I have used:-

-D                                           Debug mode, which bring this to the foreground

-v 5                                         Version 5 of Netflow

-i eth0                                   The Interface number

-n 10.20.30.15:2055         The target host IP address and port number of the collector/analyser

-T full                                     All protocols

Now running this is Debug mode is useful if you want to make sure that is working but it more useful to have this running in the background so the way we do that is to remove the –D statement in the option like such and you will just see the command prompt come back:-

[root@wbcphpxy01 ~]# softflowd -v 5 -i eth0 -n 10.20.30.15:2055 -T full

[root@wbcphpxy01 ~]#

You can still see that the flows are being “recorded” and that they are being exported in NetFlow version 5 and set to in this case 10.20.30.15 using destination port 2055.  This is done using a utility such as TCPDUMP:-

[root@wbcphpxy01 ~]# tcpdump -n –v dst port 2055

listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

14:14:01.426775 IP 10.170.5.251.35829 > 10.20.30.15.iop: UDP, length 312

14:15:01.185508 IP 10.170.5.251.35829 > 10.20.30.15.iop: UDP, length 408

14:16:01.944233 IP 10.170.5.251.35829 > 10.20.30.15.iop: UDP, length 168

Now all this is fine, but it really only becomes useful if we can stop/start and restart the application like a service and have this enabled after the server has had a reboot.  To do this we edit a file called /etc/init.d/softflowd and empty the following contents into the file and save it:-

#! /bin/bash

#

# chkconfig: 2345 80 30

# description: SoftFlow Deamon Service

### BEGIN INIT INFO

# Provides: SOFTFLOWD

# Short-Description: Start/Stop/Restart SOFTFLOWD TCP Flow Probe

### END INIT INFO

#

# SOFTFLOWD This init.d script is used to start SOFTFLOWD.

#

SOFTFLOWD=/usr/local/sbin/softflowd

VERSION="5"

INTERFACE="eth0"

COLLECTOR="10.20.30.15"

CPORT="2055"

PID_FILE="/var/run/softflowd.pid"

OPTIONS="-v ${VERSION} -i ${INTERFACE} -n ${COLLECTOR}:${CPORT} -T full -p ${PID_FILE}"

start_SOFTFLOWD() {

${SOFTFLOWD} ${OPTIONS} > /dev/null &

return 1

}

stop_SOFTFLOWD() {

if [ -f ${PID_FILE} ]; then

kill `cat ${PID_FILE}` 2>1 /dev/null

\rm ${PID_FILE}

fi

}

########

case "$1" in

start)

echo -n "Starting SOFTFLOWD"

start_SOFTFLOWD;

echo " Done."

;;

stop)

echo -n "Stopping SOFTFLOWD"

stop_SOFTFLOWD;

echo " Done."

;;

restart)

echo -n "Restarting SOFTFLOWD"

stop_SOFTFLOWD;

sleep 1

start_SOFTFLOWD;

echo " Done."

;;

*)

echo "Usage: /etc/init.d/SOFTFLOWD {start|stop|restart}"

exit 1

esac

exit 0

After saving the file, we need to change the file permissions to:-

[root@wbcphpxy01 ~]# chmod 755 /etc/init.d/softflowd

Now let’s make the script a loadable initialisation script as part of the “service <application name> start” function by adding this with the chkconfig command:-

[root@wbcphpxy01 ~]# chkconfig --add softflowd

If you need to remove the script from being initiated at boot up as a service, then issue the following:-

[root@wbcphpxy01 ~]# chkconfig --remove softflowd

Finally, let’s start the service:-

[root@wbcphpxy01 ~]# service softflowd start

Start SOFTFLOWD Done.

I would like to track this.

We are successfully using NTA 4.1.0 with other data sources and have now configured our Cisco 5508 Wireless Controllers to export NetFlow to NTA and are seeing the following error:

The WCS controllers are running software version 7.6.120.0

Is there any solution to this or do I need to make a feature request to support NetFlow in NTA from Cisco Wireless

In the interest of occasionally showing greater granularity in NPM I'd like to filter out the top few domains (which are my company's internal and external domains).  I'm not surprised they are the top destinations, and that they they take up the vast majority of the pie graph.  But I'd prefer to see everything EXCEPT my own corporate domains shown.

Is there a simple way to enter in one or more domain names into a filter and have them filtered out of the pie chart?

Or is it better to just increase the number of reported domains (Top 50?) and drill into them below the pie charts?

In this shot below, the Dark Blue, Light Blue, Brown, and light Tan wedges are my corporate domains.  I've no need to see them, and would prefer to filter them out.  How might I accomplish this?

I have been working my way through the AppFlow setup for NetScaler (I use the VM appliance) - the directions so far aren't very helpful - I'm hoping for useful examples of entries into the NetScaler AppFlow configuration section of the management interface. I was hoping for an example that would definately generate AppFlow messages to the NTA so I can verify operation, then something that would setup a useful flow of information.Thanks in advance!