Hello,

I tried to configured netflow for Cisco 3650 but I do not see the packet within PRTG. Using Wireshark, I correctly see the Netflow V9 packet coming on port 9996. I used the Netflow V9 Tester from PRTG (NetFlow 9) and I don't see any packet.

Can you please help. I have updated PRTG today to the last version.

Thanks, Fred

Article Comments

  1. Do you have sampling enabled in both the sensor and the monitored device by any chance?
  2. Is the flow timeout set correctly (usually scanning interval +1)
  3. What scanning interval is used?

Jun, 2015 - Permalink
  1. Sampling Mode is on and sampling rate is 1 (hope it is the answer you were expecting...)
  2. Active Flow timeout is set to 1 minute
  3. I don't see any scanning interval parameter. Where is it configured?

Jun, 2015 - Permalink

The scanning interval is set to 60 sec. Sorry, I didn't saw it before.


Jun, 2015 - Permalink

Does the device get a lot of traffic? You could disable the sampling for testing purposes. Remember to disable it on the device as well. The interval can be found below the sensor message field, just above the graph on the right side. Per default it's set to 60 seconds, so the active flow timeout has to be increased to two minutes.

edit
hehe already wrote the post when you posted :) increase the timeout and see if it gets values then.


Jun, 2015 - Permalink

I receive traffic every 3 seconds from the cisco. Now, I have disabled the sampling and increased the time-out to 2 minutes. How could I disable sampling on the cisco device?

I still don't receive any data.

Tks,


Jun, 2015 - Permalink

Enter global configuration mode and issue the following commands: 

show ip flow sampling
interface FastEthernet9/0/0
no ip flow-sampling-mode packet-interval

Jun, 2015 - Permalink

I already used the Netflow Tester V9 and the problem is that I do not receive anything inside this tool. BUT, I also tried with wireshark and I see all the Netflow packet coming on port 9996.

To resume, I don't understand why I see the packets on Wireshark but not on the tool.


Jun, 2015 - Permalink

Port is configured correctly? Any firewall or antivirus application that might drop the packets?


Jun, 2015 - Permalink

Yes, everything seems to be configured correctly. Normally there is no FW or antivirus application that could block. As I receive the traffic in Wireshark, it should be ok.

Any ideas?


Jun, 2015 - Permalink

I disabled the FW on the Windows server and now I can receive flow on the Netflow 9 Tester. Still don't see anything in the PRTG console.

Should I configure something different?


Jun, 2015 - Permalink

Still no traffic available within the sensor? Did you disable the netflow tester (because it will block the sensor), pause the sensor and unpause it again?


Jun, 2015 - Permalink