Multiple netflwo exporters to the same probe, ip:port ?

Kristoffer

admin "Netflow mode not enabled."

which run mode is correct for netflow v9 ?
I get netflow data but the sip and dip are from a VRF I disabled a hour ago, and its expoerter-map isnt exporting flows. I even changed the port !=2055

I dont see the netflow data from the VRF I want to monitor, even tho the box is receving udp data on port 2055.

admin

Kristoffer

NETFLOW_TAP will cover all NETFLOW/SFLOW/JFLOW/IPFIX etc all versions are automatically detected.

Are you exporting the VRFID ? You can go to Retro > Retro Counters > Then select Flow VRF from counter group.
When you go to Netflow > Routers and Interfaces do you see the router IP ?
If using Flexible Netflow , can you try assigning a source interface to the export. (eg source ethernet0/0) this will use the interface IP as the netflow source IP and that will show up as a separate routers in Trisul.

Kristoffer

How do I config trisul to only listen on incomming netflow v9 on a specific port? It seems that it is picking up all traffic on interface eth0

I want it only to listen for netflow from a specific sip and dport.

I have silk running on the same box, Im just evaluating trisul right now.

admin

Kristoffer

If you only want to listen to Netflow from a single IP then do the following.

Login as admin
Go to Context:default > profile0 > Capture Adapter
Edit ; in the BPF filter box add "host 10.82.3.3"
Save

Then
1. Go to Admin Tasks > Start / Stop Tasks
2. Change the Run Mode for probe0 to online_libpcap

Then restart the probe.

You should now only process netflow from that one IP.

I am online, let me know any issue you have with the eval.

Thanks,

Vivek

Kristoffer

1, Im using standard export from a asr9000
2, No I dont see any interface or router https://imgur.com/a/bPoS1
3, Im using a specific source interface (a interface close to the collector)

admin

Can you check the following?

Login as admin
Context: default > profile0 > Netflow Wizard
What does the last line say "Check Netflow TAP Mode" ?

It should say NETFLOW_TAP.

Also can you check the log file like so.

source /usr/local/share/trisul-probe/trisbashrc
tailf.ns

Kristoffer

https://ibb.co/hNSOM5

It seems that trisul only sees local traffic, not the netflow data it self

Kristoffer

Had to manually edit to
<TrisulMode>NETFLOW_TAP</TrisulMode>
<ValidTrisulModes>TAP,NETFLOW_TAP</ValidTrisulModes>

Kristoffer

Under Sessions I can only see the netflow exporting router and the collector
https://ibb.co/gxZ3M5

admin

Kristoffer

Can you restart the Probe after you've made that change to NETFLOW_TAP?

login as admin
Context: default > Admin Tasks > Start Stop Tasks then stop and start the probe.

That should do it.

Kristoffer

Finally! Thanx for the help. Now I can start to eval trisul.

admin

Kristoffer

Great !

Next you may want to enable "Interface Tracking" for long term breakup of interface traffic.

Enable Interface Tracking on key interfaces ;
Routers and Interfaces
Click on Router
Now for each interface , select "Options > Enable Interface Tracking"
Restart probe

Cheeers!