Submit a ticketCall us

Have You Auto Renewed? If not, you're missing out.
The SolarWinds Renewal Program comes with a host of benefits including the most recent product updates, 24/7 technical support, virtual instructor-led training and more. Experience all of this with the convenience of Auto Renewal, and never worry about missing any of these great benefits. Learn More.

Home > Success Center > Netflow Traffic Analyzer (NTA) > NTA shows "Never" or a date in the past in Netflow Sources "Last Recceived Netflow"

NTA shows "Never" or a date in the past in Netflow Sources "Last Recceived Netflow"

Overview

The Last Received NetFlow time stamp is not updating and shows a date in the past. NTA has stopped receiving NetFlow.

Environment

  • NTA any version
  • Server 2008 - Server 2012

Resolution

  1. First open Performance Monitor

  2. Add Solarwinds Netflow counters

  3. Check Flows received Per Second

  4. It is also good to validate with Wireshark. 

  5. Download and install Wireshark on your Orion Application Server:

  6. Select Capture in Wireshark.

  7. Select Options

  8. Under "Capture Filter for selected device and application port number": host <IP Address> and udp port 2055 ( default)

  9. Use the following filter when you just want to filter out data in the Wireshark application. See the Wireshark User's Guide.
    ip.addr == <Netflow Source Polling IP> && udp.port == <Netflow Collector Port>
  10. Validate that NetFlow data is reaching the collector on port 2055 (default port). The packets should be seen in Wireshark that are labeled Cflow or Sflow under Protocol.
  11. For sFlow  you will need to decode traffic and can right click on a packet and select "decode as". Settings are as follows:

 

 

 

Note: Verify the port number by checking the collector configuration under Settings > NTA Settings > NetFlow Collector Services. Validate the route the device takes to the Solarwinds server. Firewalls must be checked as some can have Access List that are not setup to allow UDP packets or setup incorrect for TCP when Netflow is UDP.

 

8. If no Netflow data is seen check example configurations to see if something is missing.

9. Run Tracert from the server to see if any other routes are in place that are blocking traffic on port 2055 (Ex: Firewall Checkpoint)

10. If all devices stopped at the same time and services are running verify the IP Address  of the Solarwinds server did not change.

10. Change the Netflow version from v5 to v9. 

 

 

 

Last modified

Tags

Classifications

Public