Hi, I have a very strange problem. I use “traffic flow” tool to send netflows from many routers to one machine, which keeps them as a log of communication. The problem is just on two routers from many (around 20). When I set the target for flows and then I check the enable checkbox, router starts to read the flows, as I can see on the status page. When there are finished flows it sends it to the collector and I can torch that traffic from the router itself. The collector receives the data and everything is OK. But, just for a few minutes… after that, router suddenly stops to send any netflow data. I can still see the counters in traffic-flow status counting the flows, but the collector is not receiving anything and I can not even torch the traffic anymore. The times differ, number of sent packets differs. I have to disable netflows and then enable it again, and when there are some finished flows, it starts to send the netflows data to the collector… But again just for a short while (5-15minutes).
I dont have any packet filter on the way from router to the collector. There are some manageable switches, but no ACLs are applied. No broadcast supression either, nothing like that… I think that I eliminated possibility of network failure, because when it stops, I can not torch the communication from the router. And when I start it the communication is recieved by the collector. So It really looks like the router stops to send the data.
It is happening on two routers, with very similar settings. Routers do have 2 ethernet interfaces, no VLANS, no tunnels, just IP FIREWALL with a few NAT and FILTER rules, lots of address-list records and theese are also working as a PCQ shapers. They also run DHCP servers, but nothing special at all. They are x86 machines with no other problems. The traffic on one of the routers is pretty high (300Mbps/100Mbps), but on the other one is around 50 Mbps. It is happening on both 3.30 and 4.11 versions of RouterOS. And I have one other router with the same service set and traffic around 150Mbps and this one is working fine, sending netflows all the time.
Any idea will be apreciated. I have already run out of ideas.
Thanks.
Peter
please make supout.rif and send it to support@mikrotik.com when problem appears
there were fixes about NetFlow in v4.6 and in v4.10, so I thought v4.11 should not stop exporting…
OK, i did that…
hope that it will help somehow. Here in Czech rep. it is mandatory for ISPs to log all traffic that goes out and in from and to your IPs. And netflow is a perfect way to do it. But because of this problem I am still not logging two of our routers.
But Thanks for the repy… a really quick one.
we’re dumping NetFlow for the same goal, and I faced that problem on v4.1/4.2 (those are not important routers). but mission-critical NetFlow in v3.28 is still rock solid for us… (knock-knock on the wood)
We have received one similar report about traffic flow that stops sending data after few minutes. We are trying to catch this problem.
If you have sent e-mail to support, we will reply to soon and will try to find the solution.
The same situation with my high loaded server.
please write to support@
p.s. has anybody tried ROS v5 on problematic routers? I wonder whether v5 have this bug…
There is no answer from support