Hello all.
I have been having issues trying to get netflow working for about a week now and I have no idea what to try next. Any thing would be worth trying.
Currently using firmware v2.0.8-hotfix.1 was able to get it working correctly with UNMS but I would really like to get it to send back to a pc on my local network.
This is my current flow-accounting settings
flow-accounting {
ingress-capture pre-dnat
interface pppoe0
interface eth1
interface eth1.150
interface eth1.151
netflow {
enable-egress {
engine-id 72
}
engine-id 71
mode daemon
sampling-rate 50
server 10.20.155.53 {
port 2055
}
server 34.87.232.186 {
port 2055
}
timeout {
expiry-interval 60
flow-generic 60
icmp 60
max-active-life 60
tcp-fin 10
tcp-generic 60
tcp-rst 10
udp 60
}
version 9
}
syslog-facility daemon
}
When i do ps aux | grep uacct I get the following.
root 18145 0.0 3.3 37404 33676 ? Ss 00:51 0:00 uacctd: Core Process [default]
root 18147 0.0 3.3 37404 33652 ? Ss 00:51 0:00 uacctd: Core Process [default]
root 18149 0.0 1.1 21192 11876 ? S 00:51 0:00 uacctd: IMT Plugin [default]
root 18151 0.0 1.1 21196 11640 ? S 00:51 0:00 uacctd: IMT Plugin [default]
root 18153 0.0 0.2 14324 2576 ? S 00:51 0:00 uacctd: Netflow Probe Plugin [10.20.xx.xx-2055]
root 18154 0.0 0.2 14324 2696 ? S 00:51 0:00 uacctd: Netflow Probe Plugin [10.20.xx.xx-2055]
root 18155 0.0 0.2 14324 2540 ? S 00:51 0:00 uacctd: Netflow Probe Plugin [34.87.xx.xx-2055]
root 18156 0.0 0.2 14324 2708 ? S 00:51 0:00 uacctd: Netflow Probe Plugin [34.87.xx.xx-2055]
and then finally do tcpdump you can see it transmit to UNMS but not locally.
01:01:37.074058 IP 203.213.115.164.43090 > 34.87.xx.xx.2055: UDP, length 504
01:01:37.074126 IP 203.213.115.164.43090 > 34.87.xx.xx.2055: UDP, length 144
01:02:09.106078 IP 203.213.115.164.36994 > 34.87.xx.xx.2055: UDP, length 384
01:02:23.981090 IP 203.213.115.164.43090 > 34.87.xx.xx.2055: UDP, length 504
01:02:23.981164 IP 203.213.115.164.43090 > 34.87.xx.xx.2055: UDP, length 324
Any ideas on what i could try to get this working would be great.