DX Unified Infrastructure Management

Have a router that is setup to send netflow data to a harvester.  I can run wireshark on the harvester and see the data coming from that router for the correct interface.  However, I do not see netflow data from the router and interface in NFA, including in the flow statistics panel. We are running on 9.3.3

You mentioned running wireshark. Does Wireshark show all of the netflow fields described in this doc:

Tech Tips: How to determine if a NetFlow enabled device is sending the correct fields

Below are the required fields for NetFlow data to be displayed in RA/NFA:

1 - IN_BYTES or 85 – IN_PERMANENT_BYTES (NFA Only)
4 - PROTOCOL
7 - L4_SRC_PORT
8 - IPV4_SRC_ADDR
10 - INPUT_SNMP
11 - L4_DST_PORT
12 - IPV4_DST_ADDR
14 - OUTPUT_SNMP

Kahlil Thomas

This is what the fields are in the wireshark capture.  Note that these are the same as the fields in a wireshark capture for a device that does show up in NFA search

SrcAddr

DstAddr

InputInt

SrcPort

DstPort

IP ToS

Protocol

SrcMask

DstMask

TCP Flags

SrcAS

DsTAS

NextHop

Octets

Packets

Duration

OutputInt

It would be interesting to see if the router is present in the harvester database. Do you see your device listed if you run the following commands (with the IP address in place of x.x.x.x) :

MySQL harvester

select * from routers where router=inet_aton('x.x.x.x');

exit

If you do see the router listed here, I would suggest opening a support ticket to help get the databases cleaned up. If the router isn't listed, then I would still suspect that there is a netflow problem.

Did the router show up in the output of the command provided above?

Lori, was this issue resolved?