It seems like traffik flow is captured pre dst nat.
This means when I’m analyzing it looks like all traffic is headed for my WAN IP.
Is it possible to get the traffik flow to capture flows post dst nat?
The ipv4 next hop address field is populated with the right destination nat address.
I am capturing on LAN bridge interface on a RB2011 with 6.37.1
As you can see in picture, the netflow 5 flows are captured after dst-nat is done.
The behavior seem to differ in ipfix. Is this a bug or working as intended?
The thread is a bit old, but I’m having similar issues. I’m trying to collect using nProbe + ntopng, and I see that v9 and IPFIX flows contain post-NAT address information, but this seems to be ignored by nProbe/ntopng - did you ever find a solution?
I’m having the same problem whereby clients appear to be downloading only minute amounts of traffic.
Hello,
Yes I think IPFIX shows to fields. src/dst addr and also post nat src/dst addr
I’m having the same issue… I’m not sure what OlofL is saying, but has anyone found a solution for this problem of ntopng not recording internal IP received traffic?