Hello, First of all thank you for some great software. I installed nfdump 1.5.2 and nfsen 1.2.4 about a week ago with little to no problems. Ubunutu server with LAMP option, I did have some Permission trouble but I have worked that out (its not pretty but it works). I am a network tech with some basic *nix skills but I'm learning fast ever since i started this project...
Some Questions.. 1. where do i find the Port tracker plugin install files/instructions. Are there any other plugins available? 2. I have added a user defined output format in nfdump, is there a way to get that format into nfsen (tried nfsen.rc start/stop) 3. Is there some sort of auto report plugin via the notification module, somehow tied to profiles? I can always cron some nfdump statements and pipe those into a mail program if there isint A problem i'm having.. We run 2 Cisco chassis here a 6006 chassis running CatOS as the switching engine and IOS for the routing engine. We get great netflow info from this chassis. The IOS sends routed only info with IFindexes corrosponding to Vlan interfaces and the CatOS send MLS inter vlan switched info with IFindexes corosponding to Physical interfaces such as port 4/5 or 3/1 ...ect The other Chassis is a 6509 running hybrid IOS which takes care of the routing and switching. We get good netflow info from this chassis as well but the porblem comes with the IFindexes being reported in the flows. All info weather routed or switched is reported with IFindexes corosponding to Vlan interfaces and 0 flows are reported with IFindexes corsponding to physical interfaces. I have tried Netflow bersion 5,7 and 9 on the router all with the same results. I have also double checked nfcapd captured flows with flow-tools captured flows and the result is always the same. Only Vlan interface IFindexes being reported in the flows. Im trying to duplicate our 6006 chasis setup onto our 6509 chasis but so far no luck due to the IFindex problem. I am attempting to find the source of this IFindex problem. Netflow data is more useful when you know what physical interface it comes from. Is the router simply not sending the info (IE. sending only flows with VLAN interface IFindexe's) but Im asking you guys first. or is the collecter not reading them (IE.not fully functional with netflow version 9, somehow aggregating or worse disregarding the flows not understanding the format). Where would i check for nfcapd logs of flows not understood or tossed out? Has anyone had this problem before? I will open a TAC with Cisco and keep the list updated. Comments...... I don't know the plans for NFDUMP/NFSEN project but I think an SNMP read engine would helpful, it would poll the router for IFindex info such as ifname or ifalias. Great program. I will be working on a NFDUMP/NFSEN server for the next little while. I'll keep you up to date if your interested. If it works out it would be a large deployemnt..300-500 profiles. If your interested Here is my userdefined nfdump output format..None of the default formats have IFindex info being reported... "%ts %td %pr %in%sap->%dap%out %pkt %byt %pps %bps %bpp %fl" Thanks for all your help -- Shane Gaumond 514-822-6000 ext: 2082 [EMAIL PROTECTED] Network technician Matrox ------------------------------------------------------------------------ *Avis de confidentialité* L'information contenue dans le présent message électronique et les fichiers qui y sont joints sont à l'usage exclusif du ou des destinataire(s) ci-dessus. Le présent message peut contenir des renseignements de nature confidentielle, exclusive ou protégée par le secret professionnel. Si vous avez reçu le présent message par erreur, vous êtes par la présente avisés qu'il est strictement interdit de le diffuser, le distribuer ou le reproduire. Si le destinataire ne peut être joint ou vous est inconnu, veuillez informer l'expéditeur par courrier électronique immédiatement et détruire toutes les copies sur support papier et supprimer le message de votre ordinateur et de votre serveur. Merci. *Confidentiality Message* The information contained in the present electronic message and the documents that are attached thereto are intended only for the use of the individual or entity to which it is addressed . This e-mail message is confidential, may be privileged and is intended for the exclusive use of the addressee(s). Any other person is strictly prohibited from disclosing, distributing or reproducing it. If the addressee(s) cannot be reached or is unknown to you, please inform the sender by return e-mail immediately and delete this e-mail message from your computer and server and destroy all copies. Thank you. ------------------------------------------------------------------------ ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
