Network Management

Find Conversations in NTA with Wireshark

When trying to see if data is being reported correctly for conversations in NTA you will need to run a Wireshark to show customers that we are reporting what the device is sending us. This filter will help filter the data in Wireshark to look for the conversation.

First published date

10/19/2018 6:29 PM

Last published date

9/28/2022 2:48 PM

Overview

When trying to see if data is being reported correctly for conversations in NTA you will need to run a Wireshark to show customers that we are reporting what the device is sending us. This filter will help filter the data in Wireshark to look for the conversation. 

 

Note: Make sure to note the time the flows in the Wireshark started to appear and then filter this out in NTA using the Absolute Time to find a good conversation to look for in Wireshark. 

Product section

Netflow Traffic Analyzer

Cause

None

Resolution

  • Issue must be occurring in NTA in order to validate this as we will not be able to troubleshoot if it is not occurring.
  • Capture the NetFlow data coming to the Orion server using Wireshark :

  • Use capture filter host <IP> and udp port 2055 to isolate that one device.

  • Note down the Start Time and End Time for the Wireshark. 

  • Run Wireshark for 10 minutes.

  • Save as a PCAP file because it defaults to PCAPNG.

  • With the Start Time and End Time noted filter out that node in NTA flow navigator for a 5-minute time frame that correlates with the Wireshark.

  • Take a Screenshot of the Top XX Conversations Chart.

 

Extra filter if you want to look in Wireshark:

 

ip.addr == <Source IP of Device Exporter>&& cflow.inputint == <Ifindex> && cflow.outputint ==  <Ifindex>

 

(ip.src == <Source IP of Device Exporter>) && (cflow.srcaddr == < Conversation SourceIP Address>) && cflow.dstaddr == <Conversation Destination IP Address> 

 

(ip.src == 10.1.1.1) && (cflow.srcaddr == 10.1.2.2) && cflow.dstaddr == 173.1.1.1