New Question
 
 
PRTG Network Monitor

Intuitive to Use.
Easy to manage.

200.000 administrators have chosen PRTG to monitor their network. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free PRTG
Download >>

 

What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general. You are invited to get involved by asking and answering questions!

Learn more

 

Top Tags


View all Tags


IPFIX ports not open on PRTG probes

Votes:

0

Your Vote:

Up

Down

I set up IPFIX on my SonicWALL according to their article:

https://www.sonicwall.com/en-us/support/knowledge-base/170505724550146

My PRTG collector has never received a single packet despite the logs on the SonicWALL showing thousands of packets sent.

When I log in to the PRTG probe server I do not see the IPFIX port open on this computer at all. I figure that it will never hear the packets if it is not listening.

Shouldn't there be a port open on the port I specified for the IPFIX Sensor? What would my next troubleshooting steps be?

They are both directly connected to the same switch. One hop. SNMPv3 is already working on this device so I know it's reachable.

ipfix port sonicwall

Created on Sep 11, 2017 4:19:28 PM by  This Guy (0) 1



8 Replies

Votes:

0

Your Vote:

Up

Down

Dear This Guy,

Thank you very much for your kb post.

Please download our NetFlow Tester. Pause the IPFIX sensor within PRTG. This is necessary to prevent the Port from being used while running the NetFlow Tester. Afterwards, run the NetFlow Tester on the same Probe (either Local Probe or Remote Probe) that has the affected sensor, configure the Tester properly and provide me with the results.

Thank you in advance.
Sebastian

Created on Sep 12, 2017 12:05:13 PM by  Sebastian Kniege [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Thanks Sebastian, I paused the sensor and started the NetFlow Tester. I could see the proper port open when I pressed start. However, nothing came in. I let it run for a few days while checking the settings on the sending device. I tried manually sending templates. Still nothing came in. Then when I turned the NetFlow Tester off and unpaused the sensor I could see that the port was opened by the PRTG probe! This was progress but still no data came in. I left everything configured the way I thought it should be.

Three days later I started getting IPFIX packets coming in but I also started getting "NetFlow data dropped (code: PE082) The NetFlow sensor has received and dropped flows with a timestamp older than the timespan defined by the active flow timeout" errors with it. I'm using the recommended timeout of 9 minutes. I bumped it up to 10 minutes and I'm still getting that error 1 or 2 times a day.

Unfortunately, I'm not sure why it suddenly started working and I also don't know why I'm getting the timestamp errors. It's possible these things are related?

Created on Sep 22, 2017 3:30:29 PM by  This Guy (0) 1



Votes:

0

Your Vote:

Up

Down

Hi there,

Please find further information regarding the Active Flow Timeout here.
The Active Flow Timeout within the sensor settings should be configured 1 minute greater than the flow timeout in the configuration of the monitored device, usually we say 5 minutes for the device and 6 minutes for the sensor in PRTG.

Do I understand you correctly that the sensor show a valid output for most time of the day? It can be related to the Active Flow Timeout though, please see the linked article above.

Best regards,
Sebastian

Created on Sep 25, 2017 10:01:23 AM by  Sebastian Kniege [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Thanks, I have already seen that article. The official guide for my SonicWALL device says to set it for 9 minutes and after reading your KB I had set my timeout to 10 minutes, just to be safe. I am getting data and I get these errors a few times a day.

Also the data appears to be incorrect, showing 4.77 kbit/s average and 15 kbit/s MAX usage. Where my SNMPv3 probe shows that we pull 1,961 kbit/s average and 78,957 kbit/s MAX.

Created on Sep 25, 2017 10:09:11 PM by  This Guy (0) 1



Votes:

0

Your Vote:

Up

Down

Hi there,

Please make sure that you follow this guide published by SonicWall:

Please be aware that as noted in the article, IPFix with extensions are not supported by PRTG.

Best regards,
Sebastian

Created on Sep 26, 2017 7:06:50 AM by  Sebastian Kniege [Paessler Support]



Votes:

0

Your Vote:

Up

Down

That is the official guide I was referring to that cites 9 minute timeout. Like I said, I'm set to 10 minutes now and still getting the error from PRTG.

Created on Sep 26, 2017 3:33:00 PM by  This Guy (0) 1



Votes:

0

Your Vote:

Up

Down

Hi there,

it appears as there is still some misleading data coming from the device in regards to the Active Flow Timeout. We've already seen this in a couple of devices / configurations in the past. Please try to improve the sensor's behavior by adjusting the Active Flow Timeout within the sensor in PRTG to 0. This might create spikes but all data will be captured.

If you still encounter any further issues regarding the sensor, please contact us directly via email to [email protected]. Please mention the knowledge base article so the case will be assigned to me.

Best regards,
Sebastian

Created on Sep 27, 2017 7:30:28 AM by  Sebastian Kniege [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Ok, thanks. I'll set the timeout to infinite and see how it goes.

Created on Sep 27, 2017 5:44:56 PM by  This Guy (0) 1



Please log in or register to enter your reply.


Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.