[ovs-discuss] Collecting NetFlow data

[Syed Faraz Ali]

Finally, hard work paid off.

I was troubleshooting with wireshark and could observe receiving NetFlow
data (cflow) on the collector VM. Also, observed that the port 2055 was
giving "destination unreachable (port unreachable)" error.

I changed the NetFlow port to 2100 on openvswitch but then didn't observe
any NetFlow data on wireshark.

I checked with my NetFlow collector and could see the incoming data. Phew!

No cflow data on wireshark, but I'm getting it on my collector. That's
pretty weird!

Anyways, thanks a lot Ben for your patience! :-)

On Fri, May 20, 2016 at 6:59 PM, Ben Pfaff <blp at ovn.org> wrote:

> Yes, that's how UDP works.
>
> On Fri, May 20, 2016 at 05:40:34PM +0200, Syed Faraz Ali wrote:
> > The connection is established even when the other machine is offline. Is
> it
> > still normal?
> >
> > # netstat -an | grep 2055
> > udp        0      0 192.168.56.104:49403    192.168.56.103:2055
> > ESTABLISHED
> >
> > # ping 192.168.56.103
> > PING 192.168.56.103 (192.168.56.103) 56(84) bytes of data.
> > From 192.168.56.104 icmp_seq=1 Destination Host Unreachable
> > From 192.168.56.104 icmp_seq=2 Destination Host Unreachable
> > From 192.168.56.104 icmp_seq=3 Destination Host Unreachable
> > ^C
> > --- 192.168.56.103 ping statistics ---
> > 5 packets transmitted, 0 received, +3 errors, 100% packet loss, time
> 4024ms
> > pipe 3
> >
> >
> >
> > On Fri, May 20, 2016 at 5:22 PM, Ben Pfaff <blp at ovn.org> wrote:
> >
> > > It seems OK.
> > >
> > > When I use a similar configuration, I see an appropriate line in
> > > "netstat -an" output:
> > >
> > > udp        0      0 192.168.42.143:52897    192.168.56.103:2055
> > >  ESTABLISHED
> > >
> > > Do you get anything like that?
> > >
> > > On Fri, May 20, 2016 at 05:11:07PM +0200, Syed Faraz Ali wrote:
> > > > >OVS isn't even opening a UDP socket.  What's in your database--can
> you
> > > > >send along /etc/openvswitch/conf.db (or whatever file you're using)?
> > > >
> > > > I configured 192.168.56.103:2055 for NetFlow.
> > > >
> > > > Kindly check the attached file.
> > > >
> > > > On Fri, May 20, 2016 at 4:56 PM, Ben Pfaff <blp at ovn.org> wrote:
> > > >
> > > > > On Fri, May 20, 2016 at 12:50:13PM +0200, Syed Faraz Ali wrote:
> > > > > > > It's probably easier to debug if you only enable NetFlow for
> now.
> > > > > >
> > > > > > Only NetFlow has been enabled.
> > > > > >
> > > > > > > Next, I'd use "strace" to see whether ovs-vswitchd is really
> > > trying to
> > > > > > > send data to the collector.  It would be using the "send"
> system
> > > call.
> > > > > >
> > > > > > Please have the output of "strace ovs-vswitchd" in the
> attachment.
> > > > >
> > > > > OVS isn't even opening a UDP socket.  What's in your database--can
> you
> > > > > send along /etc/openvswitch/conf.db (or whatever file you're
> using)?
> > > > >
> > >
> > >
> > >
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://openvswitch.org/pipermail/ovs-discuss/attachments/20160521/5baa5e06/attachment-0002.html>