Submit a ticketCall us

Get a crash course on Network Monitoring delivered right to your inbox
This free 7-day email course provides a primer to the philosophy, theory, and fundamental concepts involved in IT monitoring. Lessons will explain not only how to perform various monitoring tasks, but why and when you should use them. Sign up now.

Home > Success Center > Netflow Traffic Analyzer (NTA) > NTA shows "Never" or a date in the past in Netflow Sources "Last Recceived Netflow"

NTA shows "Never" or a date in the past in Netflow Sources "Last Recceived Netflow"

Overview

The Last Received NetFlow time stamp is not updating and shows a date in the past. NTA has stopped receiving NetFlow.

Environment

  • NTA any version
  • Server 2008 - Server 2012

Resolution

  1. First open Performance Monitor

  2. Add Solarwinds Netflow counters

  3. Check Flows received Per Second

  4. It is also good to validate with Wireshark. 

  5. Download and install Wireshark on your Orion Application Server:

  6. Select Capture in Wireshark.

  7. Select Options

  8. Under "Capture Filter for selected device and application port number": host <IP Address> and udp port 2055 ( default)

  9. Use the following filter when you just want to filter out data in the Wireshark application. See the Wireshark User's Guide.
    ip.addr == <Netflow Source Polling IP> && udp.port == <Netflow Collector Port>
  10. Validate that NetFlow data is reaching the collector on port 2055 (default port). The packets should be seen in Wireshark that are labeled Cflow or Sflow under Protocol.
  11. For sFlow  you will need to decode traffic and can right click on a packet and select "decode as". Settings are as follows:

 

 

 

Note: Verify the port number by checking the collector configuration under Settings > NTA Settings > NetFlow Collector Services. Validate the route the device takes to the Solarwinds server. Firewalls must be checked as some can have Access List that are not setup to allow UDP packets or setup incorrect for TCP when Netflow is UDP.

 

8. If no Netflow data is seen check example configurations to see if something is missing.

9. Run Tracert from the server to see if any other routes are in place that are blocking traffic on port 2055 (Ex: Firewall Checkpoint)

10. If all devices stopped at the same time and services are running verify the IP Address  of the Solarwinds server did not change.

10. Change the Netflow version from v5 to v9. 

 

 

 

Last modified
13:57, 14 Aug 2017

Tags

Classifications

Public