Hi Matthias,

could it be that your hosts does NOT accept/process the packets as those are targeted to another MAC address? If you run wireshark/tcpdump the interface to put into promiscuous mode to get them ...

If all have the same dst mac just change your interface facing the SPAN port to it.


Other than that: any host "firewall" rules active?

Markus

On 19.08.2016 11:21, Jentsch, Mario wrote:

Hi Mattias,

do you have a drawing of your setup? I have to admit that it is unclear to me…

Thanks,

Mario

*From:*pmacct-discussion [mailto:pmacct-discussion-boun...@pmacct.net] *On Behalf Of *Mattias Larsson
*Sent:* Thursday, August 18, 2016 1:36 PM
*To:* pmacct-discussion@pmacct.net
*Subject:* [pmacct-discussion] Only packets from router to netflow server

I use a SPAN port on my switch to capture all netflow (udp 2055) packets and send it to a interface where my pmacct server has one extra interface connected to.

But when I look on the traffic/packets that pmacctd genereates it seems only be the IP packets between my router and netflow server. It seems it not decodes the cisco netflow payload/data.

When I do a tcpdump on the interface and look at it with wireshark I can see see the flows.

Any suggestion what I'm doing wrong?

Thanks in advance!


Mattias



_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists


_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to