Softflowd not sending data

[mcury]

SG-3100 22.01

Installed softflowd , and its not sending any data to my netflow server, confirmed by tcpdump.
I wonder if its related to this bug: redmine #10436

[mcury]

Its not related to the redmine #10436, no Segmentation fault (core dumped).

This doesn't work:

/usr/local/bin/softflowd -D -i 1:mvneta1.100 -n 192.168.255.253:2055 -v 9 -T full -A sec -p /var/run/softflowd.mvneta1.pid
Using mvneta1.100 (idx: 1)
softflowd v1.0.0 starting data collection
Exporting flows to [192.168.255.253]:2055

This does work:

/usr/local/bin/softflowd -D -i 1:mvneta1 -n 192.168.255.253:9995 -v 9 -T full -A sec -p /var/run/softflowd.mvneta1.pid -c /var/run/softflowd.mvneta1.ctl -P udp
Using mvneta1 (idx: 1)
softflowd v1.0.0 starting data collection
Exporting flows to [192.168.255.253]:9995
ADD FLOW seq:1 [172.16.200.1]:22 <> [192.168.255.254]:48902 proto:6 vlan>:0 vlan<:0  ether:00:00:00:00:00:00 <> 00:00:00:00:00:00 
ADD FLOW seq:2 [52.38.204.228]:443 <> [192.168.255.254]:50948 proto:6 vlan>:0 vlan<:0  ether:00:00:00:00:00:00 <> 00:00:00:00:00:00 
ADD FLOW seq:3 [192.168.255.252]:50355 <> [239.255.255.250]:1900 proto:17 vlan>:0 vlan<:0  ether:00:00:00:00:00:00 <> 00:00:00:00:00:00 

ps auxwww:

/usr/local/bin/softflowd -i 1:mvneta1.100 -n 192.168.255.253:2055 -m 8192 -L 1 -v 9 -T full -A sec -p /var/run/softflowd.mvneta1.100.pid -c /var/run/softflowd.mvneta1.100.ctl

[mcury]

This post is deleted!

[mcury]

The problem happens when its listening on a VLAN.
If I change the parameter from "-i 1:mvneta1.100" to "-i 1:mvneta1", it works.

Shouldn't softflowd run only on the mvneta1 interface?
Its getting flows from everything, VLANs included, only parent interface is required

[mcury]

With -D option, I can see the daemon working, sending flows..
But nothing is actually sent, tcpdump -ni mvneta1.100 udp port 9995 remains empty..

[randomuserofnetgatethings]

Bump on this.

Same problem here on two 1100 devices. Totally fine on a much larger netgate appliance though.

If softflowd is allowed to run in "-D" for a bit ... cores out.
VERY frustrating as this blinding visibility/correlation into the vlans/subnets behind the devices. An 1100 won't do ntopng very well.

The latest docs on the netgate site don't even match the GUI for softflow settings :(

[randomuserofnetgatethings]

No one ever uses softflowd on the 1100? Or has never seen it just not send data and/or core out?

This is not reassuring that included software (regardless of who wrote it) doesn't just ... work. There aren't that many settings to fiddle with.

I mean, if the project is dead, then why is the software included at all? If one cannot support/update/maintain it ... why would one ever continue to pretend it's a legit working package?

And if the project is indeed dead ... is there no other way to dump flow data if the 1100 can't handle ntopng?

[alextg]

Did anyone manage to get this working?

I am still struggling with softflow to send data. Nothing is send and it stops working after a few minutes.

[keyser]

@alextg Consider upgrading to pfsense plus 24.03. It has a much better native netflow export feature where you can enable it on a rule by rule basis (or globally)