Verify Netflow traffic is received in NTA port 2055

This article provides instructions to check if NTA traffic is being received on the SolarWinds NTA using the Wireshark tool.

In this particular scenario, we tested it out using the default port which is 2055.

Notes:

• Your device must be correctly configured to send the required traffic on the Orion server IP and port.
• For new users, watch the following videos:

• Cisco Netflow Advanced 

• How to Configure NetFlow on a Cisco Router 

• MicroNugget: Netflow 

• Floapalooza: NetFlow, J-Flow, & sFlow Configure, Analyze, and Act on that Data - SolarWinds® Lab #4 

Filter and verify the traffics is received;

1. Install Wireshark. 
    Download Wireshark and install on your Orion Server or Kiwi Syslog Server.
Wireshark Download 

2. Disable Windows Firewall Disabled on Orion Server or Create a Rule in Windows Firewall to allow port traffic.

3. Click > Capture >  Interfaces.

4. Select the required correct interface.

5. Apply required filter.

6. Change the IP in filter of Node which is sending Netflow to Orion (Cisco/Juniper/Switch/Router) and apply.

ip.src == 192.168.1.1 && udp.port == 2055

OR

udp.port == 2055

7.  Click Apply.

You should be able to see traffic from the Nodes like Cflow (for Cisco ), flow for Juniper, or Sflow.

If you still do not see packet, check your device or network for further troubleshooting. This will confirm Orion is not receiving any packet hitting NTA default port 2055.