Community discussions

MikroTik App
 
OlofL
newbie
Topic Author
Posts: 46
Joined: Mon Oct 12, 2015 2:37 pm

traffik flow pre/post nat?

Wed Dec 14, 2016 1:10 am

It seems like traffik flow is captured pre dst nat.

This means when I'm analyzing it looks like all traffic is headed for my WAN IP.

Is it possible to get the traffik flow to capture flows post dst nat?

The ipv4 next hop address field is populated with the right destination nat address.

I am capturing on LAN bridge interface on a RB2011 with 6.37.1
 
OlofL
newbie
Topic Author
Posts: 46
Joined: Mon Oct 12, 2015 2:37 pm

Re: traffik flow pre/post nat?

Fri Dec 16, 2016 12:06 am

As you can see in picture, the netflow 5 flows are captured after dst-nat is done.

The behavior seem to differ in ipfix. Is this a bug or working as intended?
ipfix vs netflow5.PNG
You do not have the required permissions to view the files attached to this post.
 
flameproof
Frequent Visitor
Frequent Visitor
Posts: 80
Joined: Tue Sep 01, 2015 3:17 pm

Re: traffik flow pre/post nat?

Wed Feb 22, 2017 4:25 pm

The thread is a bit old, but I'm having similar issues. I'm trying to collect using nProbe + ntopng, and I see that v9 and IPFIX flows contain post-NAT address information, but this seems to be ignored by nProbe/ntopng - did you ever find a solution?

I'm having the same problem whereby clients appear to be downloading only minute amounts of traffic.
 
OlofL
newbie
Topic Author
Posts: 46
Joined: Mon Oct 12, 2015 2:37 pm

Re: traffik flow pre/post nat?

Mon May 08, 2017 3:39 pm

The thread is a bit old, but I'm having similar issues. I'm trying to collect using nProbe + ntopng, and I see that v9 and IPFIX flows contain post-NAT address information, but this seems to be ignored by nProbe/ntopng - did you ever find a solution?

I'm having the same problem whereby clients appear to be downloading only minute amounts of traffic.
Hello,
Yes I think IPFIX shows to fields. src/dst addr and also post nat src/dst addr
 
parksj10
just joined
Posts: 5
Joined: Sun Apr 09, 2017 10:45 pm

Re: traffik flow pre/post nat?

Thu May 25, 2017 9:29 pm

I'm having the same issue... I'm not sure what OlofL is saying, but has anyone found a solution for this problem of ntopng not recording internal IP received traffic?

Who is online

Users browsing this forum: arnoldmikro, Baidu [Spider], Bing [Bot], eddieb, erlinden, Google Adsense [Bot], mohkhalifa and 130 guests