I don’t really like the idea of changing the port. First, I’ve worked before on a test lab a configuration with 3 different routers, each one configured to send data on port 2055. [To configure several sources on nfsen, I simply give the source IP address, as you see below. nfsen seems to distinguish them without problem]. Second, port 2055 is an industry standard for netflow, I’m not really keen at the idea of changing that, it has many ripple effects (I have to reconfigure the router, wireshark needs to be told that 2055 is not cflow anymore, I have a firewall configured that I need to change…. )
De : Adrian Popa [mailto:[email protected]] Envoyé : jeudi 15 octobre 2015 09:52 À : LE-BRETTON, ELOUAN (ELOUAN) Cc : [email protected] Objet : Re: [Nfsen-discuss] Copy collected data from PC to server I'm not sure if the port isn't the issue. Can you try a different port for the Cisco2 device? A different port means a different collector process as well. On Thu, Oct 15, 2015 at 10:46 AM, LE-BRETTON, ELOUAN (ELOUAN) <[email protected]<mailto:[email protected]>> wrote: Here it is. %sources = ( # 'upstream1' => { 'port' => '9995', 'col' => '#0000ff', 'type' => 'netfl$ # 'peer1' => { 'port' => '9996', 'IP' => '172.16.17.18' }, # 'peer2' => { 'port' => '9996', 'IP' => '172.16.17.19' }, 'Cisco2' => { 'port' => '2055' , 'col' => '#0000FF' , 'IP' => 'u.v.w.x$ 'STSD' => { 'port' => '2055' , 'col' => '#CC00CC' , 'IP' => a.b.c.d' }, ); STSD is the router I was collecting on the PC and whose data I transferred to the server Cisco2 is the routeur I’m collecting on my serveur. At the moment I’ve come up with two possible explanations, I’ve hadn’t found the time to test if one is the correct one: 1. The time when the collection on STSD is before nfsen was installed: maybe this creates a problem because I’m trying to add data in ‘live’ profile before it was created ? 2. I’ve used this command: Launch command : nfsen –r live all. Maybe I should create another profile, a history profile, to avoid conflict between the live profile and the data?? De : Adrian Popa [mailto:[email protected]<mailto:[email protected]>] Envoyé : jeudi 15 octobre 2015 08:09 À : LE-BRETTON, ELOUAN (ELOUAN) Cc : [email protected]<mailto:[email protected]> Objet : Re: [Nfsen-discuss] Copy collected data from PC to server Can you show us your %sources config? On Wed, Oct 14, 2015 at 5:00 PM, LE-BRETTON, ELOUAN (ELOUAN) <[email protected]<mailto:[email protected]>> wrote: Hi, Here is my situation : a few weeks ago, I’ve installed nfsen on a PC and used it to collect data from a source. Let’s call Let’s call that source sourcePC. Now I’ve installed nfsen on a server, and I use it to collect data from another router, let’s call that source SourceServer. It all works fine. Now I want to import the data collected on the PC into the server. I’ve tried the following steps: - On the server, added sourcePC (using the same settings that I used on the PC). - On the server, copy the data coming from the PC - Launch command : nfsen –r live all At first it seemed to work: I could see the data coming from sourcePC, see the graph, launch some filters and stuff But then, I realized that the sourceServer didn’t work properly anymore: no new data was available from sourceServer. I’ve checked that the server was receiving netflow parquets from sourceServer (using Wireshark). If I remove sourcePC from the nfsen config file on the server, then it’s working properly… I don’t know what I should do now: how can I import the data that I collected on my PC into the server ? Regards, Elouan ------------------------------------------------------------------------------ _______________________________________________ Nfsen-discuss mailing list [email protected]<mailto:[email protected]> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
------------------------------------------------------------------------------
_______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
