Hi
I have worked a bit with the Trafficflow on our MT. I am collecting NetFlow v.5 data into our database. We have enabled All interfaces for logging. But our problem is, that it seems just to show a client calling the MT routers local interfaces and not which servers he visit on the Public interface.
We have ROS v.3.4 and 3.6
Traffic Flow settings:
admin@rph8680] > /ip traffic-flow
[admin@rph8680] /ip traffic-flow> print
enabled: yes
interfaces: all
cache-entries: 4k
active-flow-timeout: 30m
inactive-flow-timeout: 15s
[admin@rph8680] /ip traffic-flow>
Our MT has a local IP address 172.22.23.1. And a client has ip 172.22.33.70. All what I am able to see, is when the client are calling the MT local address and not the server on the internet. The only thing we can see calling the internet is the MT’s local ip address 172.22.33.1 ? I have been looking in the firewall and nat rules but I can’t find anything which is set up wrong. I might need to mark connections, but can’t see where as it is a very simple set up. We do not run web proxy on our systems.
From MT Traffic-flow:
timestamp flow id Hotspot Location source ip destination ip source port destination port protocol kbytes
2008-04-16 09:44:56 2115375 location221 172.22.23.1 193.162.194.151 48932 80 tcp 0.039
2008-04-16 09:44:52 2115374 location221 172.22.23.1 193.162.194.151 60393 80 tcp 1.146
2008-04-16 09:44:28 2115368 location221 172.22.23.70 172.22.23.1 2108 64874 tcp 0.783
2008-04-16 09:44:14 2115361 location221 172.22.23.1 80.82.99.134 55122 80 tcp 0.101
From another Probe, where a client has got ip 10.17.102.180 and is showing internet visits and local ip:
2008-04-16 10:54:47 32608 location223 194.9.24.60 10.17.102.180 80 4328 tcp 5.655
2008-04-16 10:54:47 32607 location223 10.17.102.180 194.9.24.60 4328 80 tcp 0.953
2008-04-16 10:54:47 32606 location223 81.19.69.32 10.17.102.180 80 2267 tcp 0.234
2008-04-16 10:54:46 32603 location223 64.233.183.164 10.17.102.180 80 2159 tcp 0.039
Does any one know how to get the MT traffic flow to send info like our other probes?
Cheers
Kenneth