gmane.network.nfsen.general

nfdump-1.6.10 issues v5 and ASA

Peter Haag — 2013-06-19T03:02:04

Hi list,
The new ASA 9.1.x is not properly decoded in nfdump as CISCO changed tags for translated IP addresses. So be aware of that if you upgrade to ASA 9.1.x
Furthermore, if you collect netflow v5, you may get an error in default settings, which says, it expected 7 elements, but found 2. This message can safely be ignored, as it's corrected automatically. It will be fixed in the updated version.
I'm working on both issues.

- Peter

Announcing "FlowDOH: a plugin for NFSEN"

Tristan Rhodes — 2013-06-18T21:12:49

We have developed a simple plugin called FlowDOH that leverages the power
of NFSEN.

FlowDOH can...
- Provide a real-time dashboard of the top-talkers on your network.
- Send email alerts based on traffic thresholds
- Allow quick drill-down into detailed flow information

https://sourceforge.net/projects/flowdoh/

FlowDOH has only been tested on our network, so we are asking for others to
check it out and provide feedback.  Thanks!

(I want to give credit and thanks to Stephen Rippon who performed all the
programming on this project)

Tristan

FW: http://(server)/nfsen/nfsen.php = "error HTTP 404 cannot find"

Chiang, Kim Hung [ITD] — 2013-06-17T07:57:21

resend
From: Chiang, Kim Hung [ITD]
Sent: Monday, June 17, 2013 3:21 PM
To: 'nfsen-discuss< at >lists.sourceforge.net'
Subject: ref: http://10.100.65.85/nfsen/nfsen.php = error HTTP 404 cannot find

Dear Sir,

Everything seems normal, but I cannot get the http page…WHY?? Please help us to find the cause,

[root< at >LX-MRTG-KLB01 nfsen-1.3.6p1]# ./install.pl etc/nfsen.conf
Check for required Perl modules: All modules found.
Upgrade from version '1.3.6p1' installed at Mon Jun 17 13:09:51 2013
Setup NfSen:
Version: 1.3.6p1: $Id: install.pl 53 2012-01-23 16:36:02Z peter $

Perl to use: [/usr/bin/perl]
Found /usr/local/bin/nfdump: Version: 1.6.1p1 $LastChangedDate: 2010-03-05 07:50:35 +0100 (Fri, 05 Mar 2010) $
Stop nfsend while upgrading ...done.
Setup php and html files.

Copy NfSen dirs etc bin libexec plugins doc ...
Copy config file 'etc/nfsen.conf'

In directory: /data/nfsen/libexec ...
Update script: AbuseWhois.pm
Update script: Log.pm
Update script: Lookup.pm
Update script: NfAlert.pm

ref: http://10.100.65.85/nfsen/nfsen.php = error HTTP 404 cannot find

Chiang, Kim Hung [ITD] — 2013-06-17T07:23:17

Dear Sir,

Everything seems normal, but I cannot get the http page…WHY?? Please help us to find the cause,

[root< at >LX-MRTG-KLB01 nfsen-1.3.6p1]# ./install.pl etc/nfsen.conf
Check for required Perl modules: All modules found.
Upgrade from version '1.3.6p1' installed at Mon Jun 17 13:09:51 2013
Setup NfSen:
Version: 1.3.6p1: $Id: install.pl 53 2012-01-23 16:36:02Z peter $

Perl to use: [/usr/bin/perl]
Found /usr/local/bin/nfdump: Version: 1.6.1p1 $LastChangedDate: 2010-03-05 07:50:35 +0100 (Fri, 05 Mar 2010) $
Stop nfsend while upgrading ...done.
Setup php and html files.

Copy NfSen dirs etc bin libexec plugins doc ...
Copy config file 'etc/nfsen.conf'

In directory: /data/nfsen/libexec ...
Update script: AbuseWhois.pm
Update script: Log.pm
Update script: Lookup.pm
Update script: NfAlert.pm
Update script: Nfcomm.pm
Update script: NfConf.pm
Update script: NfProfile.pm
Update script: NfSen.pm
Update script: NfSenRC.pm
Update script: NfSenRRD.pm
Update script: NfSenSim.pm
Update sc

Adding Channels to an Existing Continuous/ShadowProfile

Ray Van Dolson — 2013-06-15T14:22:54

I have a Continuous/Shadow profile that I created with two initial
channels (TX/RX for a specific subnet).  I want to add an additional
two channels now for another subnet.

When I add these channels everything seems to work fine, but I don't
see any new graph or flow data.  I note when I save the changes I don't
see any generation/processing going on that would suggest it's slurping
in the flow info based on the channels I just added.

Do I have to delete the profile and recreate it from scratch?

Thanks,
Ray

------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:

Build for Windows Store.

http://p.sf.net/sfu/windows-dev2dev

%sources question

Natxo Asenjo — 2013-06-14T12:16:06

hi,

My apologies for asking a probably simple question:

when adding more devices to the %sources hash, do I need to specify a
different port for every device?

Thanks in advance,
--
Groeten,
natxo

------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:

Build for Windows Store.

http://p.sf.net/sfu/windows-dev2dev

sflow Vlan not showing

Azher Mughal — 2013-06-11T02:39:10

Hello,

Installed latest nfsen and ncapd for the sflow. I see graphs and the
rest is very good. However Vlans selecting "Any Vlan ID" always show
Vlan 0. I looked at pcap files and proper Vlans are there in the
capture. Any hints ? Here is the installation for anyone to take a look ...

http://192.65.196.40/nfsen/nfsen.php#processing

Thanks
-Azher


------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:

Build for Windows Store.

http://p.sf.net/sfu/windows-dev2dev

DateTime one hour out on nfdump filter

David Robinson — 2013-06-06T15:44:06

Hi,
I have a problem with nfsen when doing netflow processing.

All my netflow nfcapd files have the correct date and time in the name.
The date/time within the nfcapd files is correct as all my routers are using ntp.

When I view the Details tab the tStart and tEnd date/times are correct when selecting the far right of the graph as the time slot.

However, if I then use the process button under the Netflow Processing section nfsen will pass a time that is 1 hour behind the current time.

e.g.

tstart 2013-06-06-08-20
tend 2013-06-06-08-20

Pressing the process button generates the following nfdump command:-

nfdump -M /data/nfsen/profiles-data/live/GID:PSL:NBR:K2:DAL:CAR:FOR:BOG:EAR  -T  -r 2013/06/06/nfcapd.201306060720 -n 10 -s ip/flows

You can see that the nfcapd file is 0720 instead of 0820 It's the same if a choose a Time Window, both start and end times are one hour behind


Anyone any ideas?



This message contains confidential information and is intended only for the intended recipient(s).If you a

Know upload and download flow

Ricardo Fraile — 2013-06-06T15:34:49

Hello,


   How can i know the upload and download traffic of a flow?. I only add this lines in the configuration, and i can see the graphs, but I think that the flow is upload and download, isn't it?:

%sources = (
    'Dev1'    => { 'port'    => '3907', 'col' => '#287659', 'type' => 'sflow' }
);


Thanks,

------------------------------------------------------------------------------
How ServiceNow helps IT people transform IT departments:
1. A cloud service to automate IT design, transition and operations
2. Dashboards that offer high-level views of enterprise services
3. A single system of record for all IT processes
http://p.sf.net/sfu/servicenow-d2d-j

ARP protocol

Luzifly67 . — 2013-06-03T08:08:46

Hi,

I would set a filter to only show the broadcast hosts. There is the hard
way, which it consist to set a destination filter for all subnets that I
want to monitor.But it can have the esay way, which it consist to filter by
ARP protocol, but I can't see this protocol.
Nevertheless, its a layer 3 routing protocol, like OSPF or VRRP, and I can
see these last protocols, but no ARP.

This protocol is not seen by the statistic services on the devices
(Netflow, sFlow) ?

Regards,

install nfsen

Jhonatan Ramírez — 2013-05-31T19:27:35

Hi,

Soy nuevo en nfsen, estou realizando la instalación por medio del procedimiento que indica http://sourceforge.net

Al momento de realizar: ./install.pl etc/nfsen.conf

Me aparece el siguiente mensaje:

Realice la instalación de nfdmp por medio de aptitude.

Flow-file post process best practice

James Deaton — 2013-05-30T21:55:31

I'm dealing with the routers putting in incorrect AS information into the IPFIX exports. Leveraging Tomas' recently shared Net::NfDump module I'm able to to push correct information into the files. My question is what is the best way to put it into the workflow? I am sending the question to this list because I believe I should put it into a backend plugin but I also wonder if I should be modifying the nfcapd launch to have it run my external script after each rotation (via -x).

Thanks!




------------------------------------------------------------------------------
Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
Get 100% visibility into your production application - at no cost.
Code-level diagnostics for performance bottlenecks with <2% overhead
Download for free and get started troubleshooting in minutes.
http://p.sf.net/sfu/appdyn_d2d_ap1

Crash with nfdump NSEL-1.6.10

Sebastian Hagedorn — 2013-05-22T09:13:39

Hi,

we've been using nfdump/NfSen for several years, but until yesterday I 
wasn't responsible for the software itself. We had been using nfdump 1.5.4 
and all our devices were exporting netflow version 5. Because I now want to 
support IPv6 as well I upgraded to 1.6.10. I configured nfdump on a RHEL 5 
system like this:

./configure --enable-nsel --enable-compat15 --enable-nfprofile

Then I changed one of our routers to export netflow version 9 and enabled 
flows for IPv6. Now I'm getting crashes when I try to use nfdump on nfcapd 
files from that router, e.g.:

nfdump  -r /var/local/nfsen/profiles/live/bordergw/nfcapd.201305211525 -c 1 
'proto tcp'
Date first seen          Event  XEvent Proto      Src IP Addr:Port 
Dst IP Addr:Port     X-Src IP Addr:Port        X-Dst IP Addr:Port   In Byte 
Out Byte
Verify map id 0: ERROR: Expected 7 elements in map, but found 2!
2013-05-21 15:24:42.820 IGNORE  Ignore TCP       REDACTED:58335 -> 
REDACTED:445            0.0.0.0:0     ->          0.0.0.0:445         48 
0

Last three hours graphs, but no statistics or data

James Wright — 2013-05-21T12:29:57

Hello List,

Apologies if this was previously asked or addressed, if it was I missed it.

Currently installed:

OS:  openSUSE 12.2 x64
Kernel:  3.4.6-2.10-desktop
NFDump:  1.6.9
NFSen:  1.3.6
RRD Tool:  1.4.7-4.1.2
Apache:  2.2.22-4.14.1
PHP5:  5.3.15-1.12.1

My recent install of nfdump/nfsen looks great and works well with one
exception.  I never have statistics or data for the last three hours,
though the graph seems to be correctly reflecting that same time
frame.

In the statistics area of the page I just get X's where numbers
usually appear, unless I move the timeslot back at least three hours.

Similarly, if I try to draw up any information in the Netflow
Processing area, I get errors like this:


** nfdump -M /data/nfsen/profiles-data/live/le-gw-1:le-gw:le-gw-2  -T
-r 2013/05/20/nfcapd.201305201915 -n 10 -s ip/flows
nfdump filter:
any
stat() error '/data/nfsen/profiles-data/live/le-gw-1/2013/05/20/nfcapd.201305201915':
File not found!
stat() error '/data/nfsen/profiles-data/live/le-gw/2013/05/20/nfcap

Huawei Netstream incompatibility with NFSEN

Francisco López — 2013-05-21T01:48:53

Hi NFSEN community

Does any one knows if NFSEN have incompatibility's with Netstream flow from
Huawei Routers?

Does ay one Knows if we need to change some config at the NFSEN Server?

We have been test it, with Many MTU size at the server, and the Netstream
flow report just 7 Mbps.

I'm attaching two pcap files in order to idetify the problem issue between
Flow Cisco and Netstream, also the config at the Router Huawei.

If some one knows how to work, please let me know.

Thanks community


system
 ip netstream export version 5 origin-as
 ip netstream sampler fix-packets 1000 inbound
 ip netstream sampler fix-packets 1000 outbound
 ip netstream export source 172.16.10.13
 ip netstream export host 10.13.1.46 9983
 ip netstream timeout active 60
ip netstream aggregation as
 ip netstream export source 172.16.10.13
 ip netstream export host 10.60.35.61 9993
 enable

slot 1
GigabitEthernet1/1/0
 ip netstream inbound

slot 3
GigabitEthernet3/0/0
 ip netstream inbound
 ip netstream outbound

slot 6
GigabitEthernet

nfsen (or maybe rrd) not draw diagram

Eric — 2013-05-20T04:37:14

Hi folks,

I’ve been installing nfsen for about 2 months and it works just fine. Last Friday morning I installed surfmap and it also fine.

 

This morning I found nfsen stopped drawing diagram around 2013.5.18 24:00. Restart service/computer also not helpful. 

 

 

 

 From the last screenshot, I can see there are data coming in, but not draw diagram (you can see the last update time attribute). Is there anyone can help? thanks

 


------------------------------------------------------------------------------
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security controls
from a single console and one unified framework. Download a free trial.
http://p.sf.net/sfu/alienvault_d2d_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org
https://lists.sourceforge.net/lists/lis

Nfsen scalability and data aggregation on graphs

Allen Chan — 2013-05-18T00:24:45

Nfsen has been running for 3 days now and we are loving it. Still working my way around the UI to understand the data.
I have a few questions that I cannot find an obvious answer for.

  1.  How does one scale Nfsen product to handle thousands of flows/sec? All the commercial products have ways to scale (horizontally mostly). I wonder if nfsen supports that. Multiple collectors with central nfsen server?
  2.  How is data aggregation handled? Most products start aggregating data after a certain amount of time. What is the raw data period for Nfsen and when does the product start aggregating data for graphs? Is it configurable?

Thanks,
Allen Chan

________________________________

CONFIDENTIALITY NOTICE: This e-mail and any files attached may contain confidential information of Five9 and/or its affiliated entities. Access by the intended recipient only is authorized. Any liability arising from any party acting, or refraining from acting, on any information contained in this e-mail is hereby excluded. If you

nfsen and sflow

Frank Meier — 2013-05-15T12:27:26

Hi there,

I want to capture netflow an sflow.

So I installed:
nfdump-1.6.9
/configure --enable-sflow --enable-nfprofile --enable-nftrack

nfsen-1.3.6p1

On my Linux Notebook I installed ipt_NETFLOW
and hsflowd for testing.

Netflows are capured, but nor sflow.

hsflow.conf:
DNSSD = off
  collector {
    ip = 10.66.20.204
    udpport = 2057
  }

On 10.66.20.204 nfsen.conf:

%sources = (
    'credne_netflow'    => { 'port' => '2055', 'col' => '#0000ff',
'type' => 'netflow' },
    'credne_sflow'    => { 'port' => '2057', 'col' => '#ff0000', 'type'
=> 'sflow' },
    'switch_sflow'    => { 'port' => '2056', 'col' => '#4b0082', 'type'
=> 'sflow' },
);

ps says:

nfsen    26635  0.0  0.0  17088  2632 ?        S    14:02   0:00
/bin/sfcapd -w -D -p 2056 -u nfsen -g omd -B 200000 -S 1 -P
/usr/local/nfsen/var/run/p2056.pid -z -I switch_sflow -l
/usr/local/nfsen/profiles-data/live/switch_sflow
nfsen    26642  0.0  0.0  17088  2628 ?        S    14:02   0:00
/bin/sfcapd -w -D -p 2057 -u nfsen -g omd -B 200000 -S 1 -P

Issues installing Nfsen

Allen Chan — 2013-05-10T00:32:10

Hi everyone,

I got nfcapd working and writing the flow data to file. nfdump is also showing data.
I am trying to install nfsen for the UI part of it.

I am getting this error:

[root< at >xx nfsen-1.3.6p1]# ./install.pl<http://install.pl/> ./etc/nfsen.conf
Check for required Perl modules: Failed
Required nfsen modules not found
Can't locate Mail/Header.pm in < at >INC (< at >INC contains: libexec ./libexec ./installer-items /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at ./install.pl<http://install.pl/> line 640.

[root< at >xx nfsen-1.3.6p1]# find / -name 'Header'
/usr/local/lib/perl5/5.16.2/x86_64-linux-thread-multi/Encode/MIME/Header
/usr/lib64/perl5/Encode/MIME/Header

Pretty sure i have all the requirements so this is a little puzzling. Googling the error has mostly just gotten advice to install the cpan packages...

Thanks
Allen Chan

________________________________

CONFIDENTIALITY NOTICE: This e-mail and any files attached

Message Details For Email Alerts ... ?

Wilkinson, Alex — 2013-04-26T07:24:52

Hi all,

Any progress on email body contents/details for alerts ? As question here in 2010:

http://www.mail-archive.com/nfsen-discuss-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org/msg01866.html ?

   -Alex

************** IMPORTANT MESSAGE *****************************       
This e-mail message is intended only for the addressee(s) and contains information which may be
confidential. 
If you are not the intended recipient please advise the sender by return email, do not use or
disclose the contents, and delete the message and any attachments from your system. Unless
specifically indicated, this email does not constitute formal advice or commitment by the sender
or the Commonwealth Bank of Australia (ABN 48 123 123 124) or its subsidiaries. 
We can be contacted through our web site: commbank.com.au. 
If you no longer wish to receive commercial electronic messages from us, please reply to this
e-mail by typing Unsubscribe in the subject line. 
**************************************************************

Non-latin names in profiles

Naim Shafiev — 2013-04-24T09:33:27

Hello.Is there way to make a non-latin(ascii) names in profile name?
------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_apr_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss