Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ipt_netflow Issue on Ubuntu 18: Nat Events Missing #226

Open
prometheus84 opened this issue Jan 15, 2024 · 1 comment
Open

ipt_netflow Issue on Ubuntu 18: Nat Events Missing #226

prometheus84 opened this issue Jan 15, 2024 · 1 comment

Comments

@prometheus84
Copy link

I am encountering a problem with ipt_netflow on Ubuntu 18, specifically related to missing Nat Events (NEL) in the collector logs. Here are the details of the current setup:

ipt_netflow Version: 2.6-7-g6a55739-dirty, srcversion D6E46E03E30B41A550C3B15
Protocol Version: 9 (netflow)
Refresh Rate: 20, Timeout Rate: 30
Templates: 4 (active 4)
Timeouts: Active 1800s, Inactive 15s, Maxflows 0
Natevents: Enabled, count start 338, stop 340
We are exclusively capturing Nat Events and not traffic flow. The collector being used is Netelastic. The issue at hand is that some Nat Events are not being recorded in the collector logs. Upon checking the exported conntrack, the events are observed as established. However, these events are not exported to the collector, and even after waiting for approximately 30 minutes, there is no log of these events in the collector.

It's important to note that this problem occurs randomly - some events are captured while others are missed. Any insights or solutions to address this inconsistency and ensure that all Nat Events are consistently captured and logged in the collector would be greatly appreciated.

@prometheus84
Copy link
Author

issue solved, after investigating that there was 9 hops, i reduced it to 1, now no issue

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant