Netflow needs at least two interfaces on a piece of hardware to report
correctly. For instance, I have three on my core router that are reporting. One
to each of my two upstreams ("wans") and one on my "lan".
Terri Kelley
Network Engineer
Farm to Market Broadband
On Nov 13, 2012, at 6:47 AM, Chupaka wrote:
> Torch always shows both directions of single 'connection' in one line.
> NetFlow reports two flows, for each direction.
>
> --
> Подпись:
> (добавляется в конце всех исходящих писем)
>
>
>
> 2012/11/13 Scott Reed <[email protected]>
>
>> The issue may be that torch shows one address pair, not a line for dst/src
>> and another for src/dst.
>> The send and receive columns show the traffic going the respective
>> direction.
>> I have not done enough with netflow to know that it operates correctly.
>>
>>
>> On 11/13/2012 6:57 AM, Chupaka wrote:
>>
>>> "Now run torch on ether1 you get 1/2 the traffic" - ?.. Why?.. I see all
>>> the traffic in Torch %)
>>>
>>> --
>>> Подпись:
>>> (добавляется в конце всех исходящих писем)
>>>
>>>
>>>
>>> 2012/11/13 <[email protected]>
>>>
>>> Does the Mikrotik traffic-flow / netflow correctly implement netflow?
>>>>
>>>> Reason I ask is there seems to be a disconnect between souce traffic and
>>>> destination traffic. For example if you have one interface that sees
>>>> _all_
>>>> traffic it ether1 and ip is 10.5.5.5 the customer ip address is
>>>> 192.168.1.1 ether2 there is no nat on the router etc., it just a router.
>>>> Now run torch on ether1 you get 1/2 the traffic be it source or
>>>> destination 192.168.1.1. Run torch on ether2 be it source or destination
>>>> you get the other half of the traffic. netflow / traffic-flow and torch
>>>> will not report both sides of the conversation between 192.168.1.1 and
>>>> anything else. For every inbound response to a data query there is an
>>>> outbound response that should show on that interface because it is a <two
>>>> direction> conversation.
>>>>
>>>> It appears to me that Mikrotik netflow is not doing this correctly or it
>>>> is a bungled implementation.
>>>>
>>>> Thoughts?
>>>>
>>>> Jerry Allen
>>>> Vistabeam
>>>>
>>>> ______________________________**_________________
>>>> Mikrotik mailing list
>>>> [email protected]
>>>> http://www.butchevans.com/**mailman/listinfo/mikrotik<http://www.butchevans.com/mailman/listinfo/mikrotik>
>>>>
>>>> Visit http://blog.butchevans.com/ for tutorials related to Mikrotik
>>>> RouterOS
>>>>
>>>> -------------- next part --------------
>>> An HTML attachment was scrubbed...
>>> URL: <http://www.butchevans.com/**pipermail/mikrotik/**
>>> attachments/20121113/73e8fced/**attachment.html<http://www.butchevans.com/pipermail/mikrotik/attachments/20121113/73e8fced/attachment.html>
>>>>
>>>
>>> ______________________________**_________________
>>> Mikrotik mailing list
>>> [email protected]
>>> http://www.butchevans.com/**mailman/listinfo/mikrotik<http://www.butchevans.com/mailman/listinfo/mikrotik>
>>>
>>> Visit http://blog.butchevans.com/ for tutorials related to Mikrotik
>>> RouterOS
>>>
>>> -----
>>> No virus found in this message.
>>> Checked by AVG - www.avg.com
>>> Version: 2013.0.2793 / Virus Database: 2624/5883 - Release Date: 11/08/12
>>>
>>
>> --
>> Scott Reed
>> Owner
>> NewWays Networking, LLC
>> Wireless Networking
>> Network Design, Installation and Administration
>>
>>
>> Mikrotik Advanced Certified
>> www.nwwnet.net
>> (765) 855-1060
>> (765) 439-4253
>> (855) 231-6239
>>
>>
>>
>> ______________________________**_________________
>> Mikrotik mailing list
>> [email protected]
>> http://www.butchevans.com/**mailman/listinfo/mikrotik<http://www.butchevans.com/mailman/listinfo/mikrotik>
>>
>> Visit http://blog.butchevans.com/ for tutorials related to Mikrotik
>> RouterOS
>>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> <http://www.butchevans.com/pipermail/mikrotik/attachments/20121113/9f0e1888/attachment.html>
> _______________________________________________
> Mikrotik mailing list
> [email protected]
> http://www.butchevans.com/mailman/listinfo/mikrotik
>
> Visit http://blog.butchevans.com/ for tutorials related to Mikrotik RouterOS
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://www.butchevans.com/pipermail/mikrotik/attachments/20121113/4a61c328/attachment.html>
_______________________________________________
Mikrotik mailing list
[email protected]
http://www.butchevans.com/mailman/listinfo/mikrotik
Visit http://blog.butchevans.com/ for tutorials related to Mikrotik RouterOS
