Ipswitch Forums / Network Management / WhatsUp Gold NetFlow Monitor

Interface Traffic

michoudi — Thu, 08 Jan 2009 12:51:25 GMT

I have a 3 Mbps circuit but when I view the Interface Overview Report the Interface Traffic graph sometimes shows it reaching 5,6 sometimes 10 Mbps. Can someone shed some light on this for me?

Thanks!

Listener unable to receive packets right away. Not enough available space

sha_lon — Wed, 07 Jan 2009 10:41:31 GMT

Seeing a lot of the following in the Netflow Log:

Listener unable to receive packets right away. Not enough available space

What is this about? I have not noticed any problems with the collector. Still has sufficient hd space and memory available.

netflow not seeing FrameRelay interface in the router

salwa — Thu, 18 Dec 2008 12:23:49 GMT

hi ,

once we activated the netflow on the router we got only v-sat interface. we didn't got any frameRelay interface. does any one know why ?

Limited number of Netflow sources

tschmidt — Mon, 22 Dec 2008 06:13:22 GMT

Hi,

as far as I know from the documentation the number of netflow sources is currently limited to 10.

My questions:
- Is this a "hard" limit ? Or am I able to override it ?
- Are there any plans to extend the limit ?

I know that the load and the amount of data caused by netflows depend on various things. Our intention is to use it in a medium enterprise network with about 20 sites and roughly 30 interessting routers. But the number of hosts is not x million, only about 3000.

With the defaul settings (except "Expire unclassified tarffic _> 2h) and 5 hosts (NF ver 9) our database grew during the last week only to a size of ~40MB, archive about 6MB. With a 4GB database there seems to be room for some more Netflow Sources.

Any ideas & comments ?

Regards
Thomas

Netflow & WUG on 2 seperate servers

sha_lon — Mon, 22 Dec 2008 17:21:34 GMT

hello,
Is it possible to have the netflow Plugin and the WUG on two separate machines? But still have one common web interface? Or atleast when I click on Go , Whatsup takes me to the whatsup machine and when I click Go , Netflow takes me to the Netflow machine.

I read somewhere it was possible or being considered because the netflow takes up so much resources if you have a lot of flows.

Netflow Not seeing sources

anorton — Fri, 10 Oct 2008 10:37:01 GMT

I instaleld the eval version of netflow after upgrading to 12.3 today. I have setup the 2811 router to send info to the netflow server. The Netflow server however is not seeing the information.

Here is the flow diagram

Netflow/WUP server --> Switch --> Firewall --> Router 2811

Do I need to specify a source on the router and then allow the traffic through the firewall?

Thanks

AS info

sha_lon — Thu, 04 Dec 2008 12:56:40 GMT

Does the collector support BGP flow information? Such as: Next Hop Address, Source/Dest AS Number etc.

We have enabled Netflow version 9 on our routers and was hoping to see this type of informaton which is very important to us.

Maybe possible in a future release??

--sharlon

sFlow support?

Chupathingy — Tue, 02 Dec 2008 11:12:32 GMT

Does Netflow Monitor support sFlow as well? I have Alcatel 6850 switches that I have configured and they show up in Netflow Monitor, but no data is received/accepted.

thanks!!

Robb

WhatsUp Gold 12.3.1 Released

Jason Benton — Mon, 24 Nov 2008 10:58:43 GMT

WhatsUp Gold 12.3.1 NetFlow Monitor is now available.

[b]Changes in WhatsUp Gold NetFlow Monitor v12.3.1[/b]

* Improved performance and lowered memory usage
* Modified the default data roll-up options to keep data in the database for shorter period of time
* Added support for handling multiple templates in one FlowSet when using NetFlow v9
* Improved handling of out-of-sequence packets
* Corrected problem handling source names longer than 50 characters
* Increased NetFlow database initial size to 3GB (instead of 1GB) and NFArchive database to 1GB (instead of 500MB)
* Changed default option to rebuild database indexes daily instead of weekly
* Improved performance when resolving and updating host names
* Corrected exception generated by the collector when attempting to enter a duplicate key
* Improved database maintenance page performance
* Corrected problem handling templates with many data streams in Netflow v9
* Corrected exception that occurred when the domain names were longer than the maximum allowed in the host table
* Put safeguard in place to limit memory usage by limiting size of cached data

[url=http://preview.ipswitch.com/network_management/files/iwgv12.3.1-pre.exe]WhatsUp Gold NetFlow Monitor 12.3.1[/url]

It seems the collector is unable to keep up with the amount of traffic received

vawebprop — Thu, 16 Oct 2008 13:42:40 GMT

When I started the trial, everything was working fine. On about day 7 I ran into the issue I am having now. I thought I had messed something up so I tore out the database and it started working fine. now we are two days into the new database and the collector is "not receiving" any flows. the database is on the same server, it is 2005 std (full version) and whatsup runs on the same server as well. never had any problems till now. the device sending the flows only has a DS3 attached to it so i find it hard to believe that it is getting more traffic than it can handle. This is what the log shows for a 30 min sample:

"System Log"
"Thu Oct 16 12:28:00 EDT 2008 - Thu Oct 16 12:58:00 EDT 2008"
"Date" "Message" "Severity"
"Thursday, October 16, 2008 12:56:02" "It seems the collector is unable to keep up with the amount of traffic received, 355 data elements queued" "Errors Only"
"Thursday, October 16, 2008 12:54:02" "It seems the collector is unable to keep up with the amount of traffic received, 354 data elements queued" "Errors Only"
"Thursday, October 16, 2008 12:52:02" "It seems the collector is unable to keep up with the amount of traffic received, 353 data elements queued" "Errors Only"
"Thursday, October 16, 2008 12:50:04" "Source xxx.xxx.xxx.xxx flushed in 0.88 (0.88) seconds. Stats - Keys: 8085, Flows: 41100, Packets: 302271, Bytes: 128944770, Unclassified Flows: 54" "Verbose"
"Thursday, October 16, 2008 12:50:03" "Flush Exception An item with the same key has already been added., at System.ThrowHelper.ThrowArgumentException(ExceptionResource resource)
at System.Collections.Generic.Dictionary`2.Insert(TKey key, TValue value, Boolean add)
at BWCollector.Net.CBandwidthAggregation.LoadNewAggregationKey()
at BWCollector.Net.CBandwidthSource.LoadNewAggregationKey()
at BWCollector.Net.CBandwidthCollector.AddKeysToCache()
at BWCollector.Net.CBandwidthCollector.MoveData(DateTime dLastFlush)
at BWCollector.Net.CBandwidthCollector.Flush()" "Errors Only"
"Thursday, October 16, 2008 12:50:02" "It seems the collector is unable to keep up with the amount of traffic received, 354 data elements queued" "Errors Only"
"Thursday, October 16, 2008 12:49:03" "Error moving keys System.Data.SqlClient.SqlException: Timeout expired. The timeout period elapsed prior to completion of the operation or the server is not responding.
at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection)
at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)
at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)
at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj)
at System.Data.SqlClient.SqlDataReader.ConsumeMetaData()
at System.Data.SqlClient.SqlDataReader.get_MetaData()
at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString)
at System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async)
at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, DbAsyncResult result)
at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method)
at System.Data.SqlClient.SqlCommand.ExecuteReader(CommandBehavior behavior, String method)
at System.Data.SqlClient.SqlCommand.ExecuteReader()
at WhatsUp.CRs.Open(SqlCommand oSqlCommand)" "Normal"
"Thursday, October 16, 2008 12:48:02" "It seems the collector is unable to keep up with the amount of traffic received, 353 data elements queued" "Errors Only"
"Thursday, October 16, 2008 12:46:02" "It seems the collector is unable to keep up with the amount of traffic received, 352 data elements queued" "Errors Only"
"Thursday, October 16, 2008 12:44:02" "It seems the collector is unable to keep up with the amount of traffic received, 351 data elements queued" "Errors Only"
"Thursday, October 16, 2008 12:42:02" "It seems the collector is unable to keep up with the amount of traffic received, 350 data elements queued" "Errors Only"
"Thursday, October 16, 2008 12:40:02" "It seems the collector is unable to keep up with the amount of traffic received, 349 data elements queued" "Errors Only"
"Thursday, October 16, 2008 12:38:30" "Source xxx.xxx.xxx.xxx flushed in 0.63 (0.63) seconds. Stats - Keys: 7152, Flows: 41010, Packets: 293898, Bytes: 124596549, Unclassified Flows: 29" "Verbose"
"Thursday, October 16, 2008 12:38:29" "Flush Exception An item with the same key has already been added., at System.ThrowHelper.ThrowArgumentException(ExceptionResource resource)
at System.Collections.Generic.Dictionary`2.Insert(TKey key, TValue value, Boolean add)
at BWCollector.Net.CBandwidthAggregation.LoadNewAggregationKey()
at BWCollector.Net.CBandwidthSource.LoadNewAggregationKey()
at BWCollector.Net.CBandwidthCollector.AddKeysToCache()
at BWCollector.Net.CBandwidthCollector.MoveData(DateTime dLastFlush)
at BWCollector.Net.CBandwidthCollector.Flush()" "Errors Only"
"Thursday, October 16, 2008 12:38:02" "It seems the collector is unable to keep up with the amount of traffic received, 350 data elements queued" "Errors Only"
"Thursday, October 16, 2008 12:37:29" "Error moving keys System.Data.SqlClient.SqlException: Timeout expired. The timeout period elapsed prior to completion of the operation or the server is not responding.
at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection)
at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)
at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)
at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj)
at System.Data.SqlClient.SqlDataReader.ConsumeMetaData()
at System.Data.SqlClient.SqlDataReader.get_MetaData()
at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString)
at System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async)
at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, DbAsyncResult result)
at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method)
at System.Data.SqlClient.SqlCommand.ExecuteReader(CommandBehavior behavior, String method)
at System.Data.SqlClient.SqlCommand.ExecuteReader()
at WhatsUp.CRs.Open(SqlCommand oSqlCommand)" "Normal"
"Thursday, October 16, 2008 12:36:02" "It seems the collector is unable to keep up with the amount of traffic received, 349 data elements queued" "Errors Only"
"Thursday, October 16, 2008 12:34:02" "It seems the collector is unable to keep up with the amount of traffic received, 348 data elements queued" "Errors Only"
"Thursday, October 16, 2008 12:32:02" "It seems the collector is unable to keep up with the amount of traffic received, 347 data elements queued" "Errors Only"
"Thursday, October 16, 2008 12:30:02" "It seems the collector is unable to keep up with the amount of traffic received, 346 data elements queued" "Errors Only"
"Thursday, October 16, 2008 12:28:02" "It seems the collector is unable to keep up with the amount of traffic received, 345 data elements queued" "Errors Only"

Netflow stopped working for Cisco 4510R switches

jbradley76 — Wed, 19 Nov 2008 06:43:03 GMT

Hi,

I'm currently running an Eval of What's Up Gold and the Netflow aspect of this has been of great interest/value, however as of yesterday it stopped working. This was caused by a change I made, but now cannot get it working again!

I had 3 network sources all sending data fine to the What's UP server. I changed the IP address of the server and added it to my local domain(previously was in a workgroup).

I reconfigured the 2 x 4510's and the 1721 with:

ip flow-export destination x.x.x.x 9999 (where x.x.x.x is the new Ip of the Whats up server)

The 1721 is successfully sending NetFlow info to the server, however for the 4510's I get a "Not receiving" status.

Any ideas?

How to view unclassified traffic on a small stream

khansen — Mon, 10 Nov 2008 10:59:10 GMT

Hi,

I've got a question on viewing an unclassified TCP port for a particular stream. The conversation is very small, so it falls outside of the normal criteria of unclassified traffic of the top 100 per hour. I really need to see what this port is, is there anyway to do a custom report to view the specific port information on this very small stream?

Thanks!

Kim

Any limit for netflow records

ityung — Thu, 13 Nov 2008 04:54:23 GMT

May I know the number of netflow records that can be handled by NetFlow plug-in ? At present, there are around 400 millions records needed to be handled on our site everyday. Can NetFlow still handle such huge records? :)

NetFlow Sources

mgcasey — Thu, 13 Nov 2008 09:54:14 GMT

I have a Netgear ProSafe VPN Firewall FVS318v3. The Firewall used UDP port 514 for log information. I setup Rules on the Firewall the allow UDP 514 traffic to my machine running NetFlow 192.168.111.30.

When I go to NetFlow Sources the Firewall shows up. NetFlow traffic status says Not Receiving.

Is it possible to configure a Netgear Firewall to report to NetFlow?

Multicast stats in Netflow Monitor

khansen — Thu, 23 Oct 2008 11:16:56 GMT

Hi,

I know that netflow stats for multicast are available w/ Netflow version 9, I was wondering if I could still see the IP associated addresses w/ Netflow version 5 (I'm stuck there until I can get my Cisco equipment upgraded to support version 9). I could see the amount of traffic in/out to mulicast addresses on a previous collector, I was wondering if I could do the same w/ Netflow collector using version 5?

Thanks!

Kim