Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Pfflowd not exporting any flows

    Scheduled Pinned Locked Moved pfSense Packages
    10 Posts 3 Posters 4.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      HypeTelecon
      last edited by

      I am running pfSense 1.2.3-RELEASE. I installed the pfflowd package but I can not get it to export any flows. I have it configured like this:

      Host: (IP address of Orion NPM + NTA server)
      Port: 2055
      pf rule direction restriction: any
      Netflow version: 5

      I have Orion NTA set to receive flows from bge0 and bge1, but it never receives any netflow packets. Is there something special I have to do to make pfSense pfflowd work with Orion NTA? Whenever I go to Status -> Services section of pfSense, it has a green play icon next to pfflowd and say that it is running.

      Can anyone help me with this?

      1 Reply Last reply Reply Quote 0
      • R
        rkelleyrtp
        last edited by

        Where is your Orion host located on your network?  On the LAN side of pfSense or somewhere else?  This may simply be a rules problem.  Can you draw a picture of your network?

        1 Reply Last reply Reply Quote 0
        • H
          HypeTelecon
          last edited by

          Orion is on the LAN side of the pfSense server. They are both on the same subnet. In the pfSense LAN firewall rules, it is a simply "allow all" or "any <-> any".

          1 Reply Last reply Reply Quote 0
          • R
            rkelleyrtp
            last edited by

            Which OS is installed on your Orion host (Windows, Linux, etc).  At this point, I would get a network trace from the Orion host to see if you are getting any traffic from your pfSense box.  On windows, install Wireshark and capture packets from your pfSense box.  On Linux, get a terminal and run, "tcpdump -i <interface>".

            This should show you if your Orion host can see any packets from your pfSense box.</interface>

            1 Reply Last reply Reply Quote 0
            • H
              HypeTelecon
              last edited by

              @rkelleyrtp:

              Which OS is installed on your Orion host (Windows, Linux, etc).  At this point, I would get a network trace from the Orion host to see if you are getting any traffic from your pfSense box.  On windows, install Wireshark and capture packets from your pfSense box.  On Linux, get a terminal and run, "tcpdump -i <interface>".

              This should show you if your Orion host can see any packets from your pfSense box.</interface>

              Well this doesn't make any sense at all. I can see Netflow v5 packets coming from my pfSense box, but it's acting like it isn't receiving anything.

              1 Reply Last reply Reply Quote 0
              • R
                rkelleyrtp
                last edited by

                Well this doesn't make any sense at all.

                I assume you mean your results and not my reply?  :)

                Do you have a firewall configured on your Orion box that may be blocking the incoming data?  Perhaps the Orion software needs to be configured to receive traffic explicitly from your pfSense box?

                1 Reply Last reply Reply Quote 0
                • H
                  HypeTelecon
                  last edited by

                  @rkelleyrtp:

                  Well this doesn't make any sense at all.

                  I assume you mean your results and not my reply?   :)

                  Do you have a firewall configured on your Orion box that may be blocking the incoming data?  Perhaps the Orion software needs to be configured to receive traffic explicitly from your pfSense box?

                  It's a Windows Server 2003 R2 Standard Edition x32 box. There is no firewall running on it. I can see my pfSense box sending Netflow packets to it when I look in Wireshark, but Orion is acting like it isn't receiving anything from it. However, Orion is reading netflow packets from all my Cisco routers like a champ.

                  And yes, I was implying what I saw in Wireshark didn't make any sense to me, not your suggestion! Ops!

                  1 Reply Last reply Reply Quote 0
                  • H
                    HypeTelecon
                    last edited by

                    Ahh crap, I just found this on the Orion forums:

                    We ran into the same problem, we are getting netflow statistics from some non cisco gear on our network. In the netflow packet that gets sent out from the router to Orion it will contain a index value. This index value comes from the interface that the traffic was seen on.

                    For example: lets say the netflow packet looked something like this:

                    SrcAddr: someip
                    DstAddr:someip
                    InputInt: 5
                    outputint: 4
                    packets: 1
                    octests: 81
                    etc…

                    On cisco devices the input int and output int are equal to the snmp interface index. I know that nprobe(a netflow colector program) will generate a pseudo random number for that input and output int. when Orion recives this it is looking for an interface index which it doesent, and cant really know about. The workaround that i have used is I create a custom interface with the index that is needed to collect the data.

                    Here is my list of known software that will have this issue:

                    nprobe
                    pfflowd

                    1 Reply Last reply Reply Quote 0
                    • R
                      rkelleyrtp
                      last edited by

                      wow, that sucks!

                      1 Reply Last reply Reply Quote 0
                      • L
                        ltitus210
                        last edited by

                        IDK if ur interested in using a different collector but I use Scrutinizer and it works just fine. I'm only using the free version too. It still shows me all the useful data i need to see for an unlimited number of devices.

                        http://www.plixer.com/products/netflow-sflow/scrutinizer-netflow-sflow.php

                        ~Larry T

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.