I'm running NetFlow v9 on a Cisco router. The router supports adding multiple flow statements to the same interface. So I have 4 statements, 2 for IPv4 ingress/egress and 2 for IPv6 ingress/egress. Checking to see what is exported I can see that ingress/egress for both protocols are being exported. PRTG doesn't seem to pick this up though. For one it only shows IPv4 Egress when I have all four commands on the interface. I can't seem to find any documentation stating if PRTG is directionally aware or not.
thank you very much for your KB-Post. PRTG does not differ between in- and outbound traffic on xFlow and/or Sniffer-Sensors. It will show the traffic type, as in protocols used. And then in the Toplists the sources and destination of the streams. You could check the Toplists for the directions of specific streams, if they are inbound or outbound. But it's not shown on the sensor result as on a SNMP Traffic Sensor for example.
Ok that helps. After looking a previous post I found that IPv6 isn't supported for NetFlow, that was awhile ago. Any ideas if that has changed? I also noticed that a custom top list for AS Destinations that I made doesn't populate. It just says 100% Other. Does that mean they vary so much that it can't determine a top 100 or do I need to setup something differently?
IPv6 for Netflow is still only on the wishlist I'm afraid. I will count your vote for it!
Custom Toplists with the AS-Fields are a bit tricky, can you please try including maybe source & destination - IP -fields? Does it then show the AS column in the Toplist?
So I added Source/Destination IP to my list which already had Source/Destination ASI. The list now shows several entries with Source/Destination IP but the AS fields show a "0" in both Source/Destination ASI columns.
Just to check, did you create this Toplist anew? It might be, that the sending device doe snot send AS information. Can you please enable the sensors function to write a "Log Stream Data to Disk" for all data. Please then check the according CSV, if AS-information is included.
Yes this is a new Toplist. The sending device should be sending, it is a Cisco router and I setup what was suggested in the guides. One thing to note is that with the logging on for the sensor I can't see that the file gets created anywhere. I used the two below links for reference. My understanding is that it should be under C:\Program Files(X86)\PRTG Network Monitor\, however I don't have a Stream Log folder. Did this move and I'm reading something out of date?
The files will be with the Program Data not with the Program Files. i.e. "%programdata%\Paessler\PRTG Network Monitor"
Under that folder you should see a folder called StreamLog and the files should be there.
I appear to have gotten the AS information to work. The issue appears to be router related. My 7606S's seem to work fine with an AS Toplist. My ASR9K's don't seem to want to work. I'm going to open a TAC case and see what they have to say about it. It's got all the configs needs according to the setup guide.
Thanks for letting us know and if you find a solution, please post it here!