Problem running Traffic Flow

joba · July 8, 2019, 10:29am

Dear all,

I’m trying to collect Netflow/IPFIX data form a RB1102AHx2 box but I don’t receive anything and on the Traffic Flow Settings Status, all counters always show 0
Here are my config
enabled: yes
interfaces: Internal-lan
cache-entries: 16k
active-flow-timeout: 1m
inactive-flow-timeout: 15s

SRC-ADDRESS DST-ADDRESS PORT VERSION

0 0.0.0.0 192.168.0.253 1234 ipfix
Changed interfaces to wan but same result.

What am I missing ?

Thank you,

sebastia · July 8, 2019, 12:29pm

Hey

Which interfaces are in the list " Internal-lan"? It’s not empty right?

joba · July 8, 2019, 1:04pm

Thanks,

internal-lan is ether2, while wan is ether1

BR

sebastia · July 8, 2019, 2:05pm

See also https://wiki.mikrotik.com/wiki/Manual:IP/Traffic_Flow

Normally that should be a single (two to change server address) step operation.

Post your config, so it can be consulted: /export hide-sensitive

joba · July 9, 2019, 7:02am

Hi again,

Please find the config:

jul/09/2019 08:00:58 by RouterOS 6.44.3

software id = SBVX-T5T0

model = 1100AHx2

serial number =

/queue type
add kind=pcq name=Upload-Queue pcq-burst-rate=6500k pcq-classifier=
src-address pcq-dst-address6-mask=64 pcq-rate=6M pcq-src-address6-mask=64
add kind=pcq name=Download-Queue pcq-classifier=dst-address
pcq-dst-address6-mask=64 pcq-rate=6M pcq-src-address6-mask=64
/queue simple
add disabled=yes name=Queue-Limitation queue=Upload-Queue/default target=
192.168.0.0/24
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0
add addresses=192.168.0.254/32 name=m1nDurOwnbuzz
/system logging action
set 1 disk-stop-on-full=yes
set 3 remote=192.168.0.254
/user group
add comment=“accounting user” name=sniffer policy=“ssh,read,!local,!telnet,!ft
p,!reboot,!write,!policy,!test,!winbox,!password,!web,!sniff,!sensitive,!a
pi,!romon,!dude,!tikapp”
/interface bridge port
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=ether2-LAN-OFFICE
add bridge=bridge2 interface=ether7
add bridge=bridge2 interface=ether8
add bridge=bridge2 interface=ether9
add bridge=bridge2 interface=ether10
add bridge=bridge2 interface=ether6
/interface l2tp-server server
set enabled=yes
/interface pptp-server server
set enabled=yes
/ip accounting
set enabled=yes threshold=2560
/ip accounting web-access
set accessible-via-web=yes address=192.168.0.252/30
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether12 network=
192.168.88.0
add address=192.168.0.1/24 interface=bridge1 network=192.168.0.0
/ip dhcp-server lease

/ip dhcp-server network
add address=192.168.0.0/24 dns-server=nn.nn.nn.nn gateway=
192.168.0.1
/ip dns
set servers=nn.nn.nn.nn,pp.pp.pp.pp
/ip firewall address-list
/ip firewall filter
add action=accept chain=forward comment=“alibaba site” content=alibaba.com
src-address=192.168.0.0/24
add action=drop chain=forward comment=“DROP VPN / PPTP forward” protocol=gre
src-address=192.168.0.0/24
add action=drop chain=forward comment=“IPSEC-ESP F” protocol=ipsec-esp
src-address=192.168.0.0/24
add action=drop chain=forward comment=“IPSEC-AH F” protocol=ipsec-ah
src-address=192.168.0.0/24
add action=drop chain=input comment=“DROP VPN / L2TP” dst-port=500 protocol=
udp
add action=accept chain=forward comment=“Server Win 2012” src-mac-address=
74:D4:35:71:01:55
add action=drop chain=input comment=“NAT TRANSVERSAL” disabled=yes dst-port=
4500 protocol=udp
add action=drop chain=forward comment=Phone17 src-mac-address=
30:39:26:01:51:39
add action=drop chain=forward comment=Phone19 src-mac-address=
9C:A9:E4:32:7F:6B
add action=drop chain=forward comment=Android16 src-mac-address=
E4:32:CB:D0:74:FE
68:DF:DD:41:5B:A9
add action=drop chain=forward comment=Android581 src-mac-address=
14:9F:E8:F4:9E:4B
add action=drop chain=forward comment=RAR disabled=yes layer7-protocol=RAR
src-address=192.168.0.0/24
add action=drop chain=forward comment=MKV content=.mkv src-address=
192.168.0.0/24
add action=drop chain=forward comment=MOV content=.mov src-address=
192.168.0.0/24
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes
/ip proxy
set src-address=192.168.0.1
/ip route
add distance=1 gateway=pppoe-isp
/ip service
set telnet disabled=yes port=8023
set ftp disabled=yes
set www address=192.168.0.0/24 port=89
set ssh address=192.168.0.0/24
set api disabled=yes
set api-ssl disabled=yes
/ip traffic-flow
set active-flow-timeout=1m cache-entries=16k enabled=yes interfaces=
ether2-LAN-OFFICE
/ip traffic-flow target
add dst-address=192.168.0.254 port=1234 version=ipfix
/snmp
set enabled=yes trap-community=m1nDurOwnbuzz trap-version=3
/system clock
set time-zone-name=Indian/xx
/system identity
set name=Anarana
/system ntp client
set enabled=yes primary-ntp=tt.tt.tt.tt server-dns-names=“”
/tool graphing interface
add interface=ether1-WAN-FO store-on-disk=no
add interface=bridge1 store-on-disk=no
add interface=ether1-WAN-FO store-on-disk=no
/tool graphing queue
/tool sniffer
set filter-interface=ether1-WAN-FO filter-ip-address=192.168.0.0/24
filter-ip-protocol=tcp filter-port=!996 filter-stream=yes
streaming-server=192.168.0.253

joba · July 9, 2019, 8:23am

Sorry for duplicate

sebastia · July 11, 2019, 10:53am

Hey

The ether2 is “slave”, as it’s part of bridge1.

/interface bridge port
add bridge=bridge1 interface=ether2-LAN-OFFICE
/ip traffic-flow
set active-flow-timeout=1m cache-entries=16k enabled=yes interfaces=ether2-LAN-OFFICE

Try monitoring bridge1 instead then.

joba · July 11, 2019, 2:54pm

Hi,

Thanks for your answer. I tried interface “all” and got data from mikrotik.

Thanks for your help !