Hi, guys.
I’ve set up the traffic flow with the following settings:
/ip traffic-flow> print
enabled: yes
interfaces: ether2
cache-entries: 4M
active-flow-timeout: 1m
inactive-flow-timeout: 1s
/ip traffic-flow target> print detail
0 src-address=1.1.1.1 dst-address=2.2.2.2 port=10000 version=9 v9-template-refresh=30 v9-template-timeout=1m
What happens, is that, when there’s no “overload” of the monitored interface, in this case “ether2”, the flows are sent properly.
However, when there is complete usage (100%) of the capacity on “ether2”, then, flows are not sent anymore. (I can see there’s traffic flow data coming, however, they don’t contain the subnets using the traffic in ether2, making it useless).
My question is, why the full capacity usage of “ether2”, causes Mikrotik CCR 1009, to do not send flows to the flow collector ?
Please note, CPU usage is 10~12% in this test, and we’re using a separated management interface for flow collection (ether3), without packet loss, and woking in proper condition.
/system resource print
uptime: 4d20h47m2s
version: 6.44.5 (long-term)
build-time: Jul/04/2019 10:32:21
factory-software: 6.36.4
free-memory: 1420.8MiB
total-memory: 1984.0MiB
cpu: tilegx
cpu-count: 9
cpu-frequency: 1200MHz
cpu-load: 12%
free-hdd-space: 78.6MiB
total-hdd-space: 128.0MiB
architecture-name: tile
board-name: CCR1009-7G-1C-1S+
platform: MikroTik
Any thoughts on this ? Something is wrong, but not sure what yet…