On the file “fastnetmon_mikrotik.php” line 51 has those argument
$msg .= “php fastnetmon_mikrotik.php [IP] [data_direction] [pps_as_string] [action] \n”;
but I still get the same error
Hi any help to make the php script running will be appreciated
if ( $argc <= 4 ) {
$msg .= "MikroTik’s API Integration for FastNetMon - Ver: " . _VER . “\n”;
$msg .= “missing arguments”;
$msg .= “php fastnetmon_mikrotik.php [IP] [data_direction] [pps_as_string] [action] \n”; <------------------Script stop working in this line
echo $msg;
exit( 1 );
}
Any idea?
Long post NO SUPPORT
Hello!
I think you can get help from FastNetMon’s community directly.
Please use any availible ways to ask community from https://fastnetmon.com
Hello!
Please follow our official guide to fix this issue: https://fastnetmon.com/docs/influxdb_integration/
I think we found bug in Netflow v5 implementation in RouterOS: 6.40.8 Due to some issues, Mikrotik sends Netflow v5 packets with enormous amount of bytes and packets and causes false positive alerts about attacks.
It looks like this way:
We’re starting process to report this issue to Mikrotik and work very close with customer.
Hi,
Which is the best current configuration to the Mikrotik integration with FastNetMon?
I’m using those:
- Cache entries = 128k
- Active Flow Timeout = 00:01:00
- Inactive Flow Timeout = 00:01:00
Netflow version = 9
Template refresh = 30
Template timeout = 30
FastNetMon is receiving data correctly, but Grafana shows the graphic sawed (a lot of peaks):
If you are storing the data on Graphite you can try to smooth the graphs out by applying a moving average filter on each series in the grafana metrics.
I presume there’s the same function on InfluxDB as well.
Your NetFlow settings look ok. You can get a little bit more precise (direct) data by decreasing the inactive flow timeout to 1s.
I personally gave up on NetFlow with MikroTik for FNM. It never worked ok. It gave constant false positives for long lived TCP flows.
I ended up mirroring the traffic via SPAN ports on the switch level to the FNM box. It captures everything in real time and in turn Grafana shows the most accurate graphs this way.
But I still use NetFlow on MikroTik with pmacct to log the traffic each IP does which is close to the real numbers (always less though), for accounting reasons.
Excellent, Inactive Flow Timeout = 00:00:01 showed smoother graphs:
Thanks!
Yes, Mikrotik does not cut long TCP downloads / UDP transfers into smaller ones (like almost all other vendors do) and it causes huge spikes. Recently we did some research with 60s/60s configuration with 50kpps flow and Mikrotik generated flows with 3m packets!
tomasi how did you set so small limit? Previously, minimum limit for inactive/active flows was 60 seconds.
Maybe it was corrected in the new versions (that of image is 6.40.8 ).
RouterOS just accepted, no complained about the 00:00:01 value 
Nice! Thank you for reply! Does it allow smaller limit for active timeout too?
It doesn’t allow smaller limits
Active Flow Timeout must be greater than 00:00:59
Thank you for checking! Would be nice if they can reduce this one too It will improve attack detection speed a lot.
Hello!
Looks like we have great news and in latest unstable release Mikrotik allows 1 second timeout for active and inactive Flow timeouts!
Thank you for creating this post, it helps much.
Hi Dear
When Install Grafana Server in Access mode only Server and Browser mode
How config Flow Active timeout
in Active timeout
Cache Entrie
Template Refresh and Template Timeout
That Fastnetmon Recieve Correct By netflow Version 9
I Set In Fastmon
average_calculation_time = 65
average_calculation_time_for_subnets = 65
And Active timeout Flow 60 Second
Fastnwtmon Show me
Incoming traffic 301537 pps 2557 mbps 15587 flows
But my traffic is 1900Mbps