Hi I have simple setup which I can emulate in GNS3 with CHR. Setup is one CHR (ro real it does not matter) router with one port connected to internet and one lan port. I have enabled DHCP, masquarede and IPFIX on router with masquarade. Configuration and topology is following. Left part of topology is similar setup on cisco and right part is described configuration.
complete MikroTikChr1 config is
# apr/19/2020 18:03:13 by RouterOS 6.45.6
# software id =
#
#
#
/interface ethernet
set [ find default-name=ether1 ] disable-running-check=no
set [ find default-name=ether2 ] disable-running-check=no
set [ find default-name=ether3 ] disable-running-check=no
set [ find default-name=ether4 ] disable-running-check=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=p78 ranges=10.78.0.10-10.78.0.20
/ip dhcp-server
add address-pool=p78 disabled=no interface=ether4 name=server1
/ip address
add address=10.78.0.1/24 interface=ether4 network=10.78.0.0
/ip dhcp-client
add disabled=no interface=ether1
/ip dhcp-server network
add address=10.78.0.0/24 dns-server=8.8.8.8 gateway=10.78.0.1
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
/ip traffic-flow
set enabled=yes
/ip traffic-flow target
add dst-address=192.168.0.47 port=4739 version=ipfix
and problem is when I make some connection to internet I see one connection multiple times. For exmaple when I open https connection I see that connection at collector as 3 flows. I see folowing:
in the similar configuration at cisco router I see it as I expect as one flow.
There are two problems. First is that probably connection initalization packet (3rd row) is separated from other packets in stream (it differs in TCP FLAGS) and second problem is that I sometimes see (correct) local adress for flows trafeling from PC to internet and for responses (ie. packets traveling from internet to PC) I see router’s public address instead.
This makes very hard to monitor flows. Is there any option how to solve that or it is bug or feature?