How to determine if a NetFlow enabled device is sending the correct fields and data using WireShark.

Document ID:  TEC597610
Last Modified Date:  03/17/2017
{{active ? 'Hide' : 'Show'}} Technical Document Details

Products

  • CA Application Delivery Analysis
  • CA Application Delivery Analysis Multi-Port Monitor
  • CA Infrastructure Performance
  • CA Network Flow Analysis
  • CA Network Flow Analysis Managed Service Offering

Releases

  • CA Network Flow Analysis:Release:9.0
  • CA Network Flow Analysis Managed Service Offering:Release:9.0
  • CA Network Flow Analysis:Release:9.1
  • CA Network Flow Analysis Managed Service Offering:Release:9.1
  • CA Application Delivery Analysis:Release:9.3

Components

  • NQRPTA - REPORTERANALYZER:NQRPTA

Description:

ReporterAnalyzer(RA) and Network Flow Analysis(NFA) require that certain fields are sent from a NetFlow enabled device in order for the software to display data properly.

If one or more of these fields are not sent along with the NetFlow data, RA/NFA may either show incorrect data or no data at all from that device.

Most NetFlow v5 devices send the same fields regardless, however in NetFlow v9 and newer, the device needs to send a template which tells the receiver of the data how to interpret the data. This may still be necessary for troubleshooting some NetFlow v5 devices as well.

Below are the required fields for NetFlow data to be displayed in RA/NFA:

 

     1 - IN_BYTES or 85 - IN_PERMANENT_BYTES (NFA Only)       
     4 - PROTOCOL 
     7 - L4_SRC_PORT
     8 - IPV4_SRC_ADDR
     10 - INPUT_SNMP
     11 - L4_DST_PORT
     12 - IPV4_DST_ADDR
     14 - OUTPUT_SNMP

 

Solution:

You can verify that these fields are being sent by running WireShark on the Harvester which the device is sending data to.

**Note that the steps for the Capture Filter may vary slightly depending on the version of Wireshark this example is based off of version 1.8.6**

  1. Open WireShark on the Harvester server and go to the "Capture" top menu and then "Options"

    Figure 1
  2. Double click the Interface which is receiving the NetFlow

    Figure 2
  3. In the "Capture Filter" field enter "host x.x.x.x and udp port 9995" where x.x.x.x is the IP address of the device you wish to monitor, and click OK

    Figure 3
  4. Click "Capture->Start" to begin capturing data.

    Figure 4
  5. Once you have captured enough data click Stop and then "Analyze->Decode As"

    Figure 5
  6. Change the drop down menu to "Destination (->9995)" and select "CFLOW" on the right and click OK

    Figure 6
  7. To find the datagram that has the Netflow template you can enter "cflow.template_id" in the Filter field and it will filter down to only datagrams that contain a Netflow Template.

    Here you can check to see if the required NetFlow fields are being sent in the template.

    If you expand the section below which says "Template (ID = ....)" You can see a list of the fields being sent and match them up with the required fields from above.

    Figure 7
  8. To view the actual values for these fields being sent, clear the cflow.template_id filter and click on any other datagram.

    Expand where it says "Cisco NetFlow/IPFIX" and expand one of the Flowsets until you can see a list of the fields and values like below, make note that the "FlowSet Id: (Data)" value matches the template ID, like in this case it is 256, to ensure you are looking at the correct flow:

    Figure 8

Please help us improve!

Will this information enable you to resolve your issue?

Please tell us what we can do better.

{{feedbackText.length ? feedbackText.length : '0'}}/255

{{status}}

Not what you were looking for?

Search Again >

Product Information

Support by Product >

Communities

Join a Community >