CESNET / ipfixcol2

High-performance NetFlow v5/v9 and IPFIX collector (RFC7011)
Other
122 stars 36 forks source link

Number of records in NetFlow v9 Message header doesn't match number of records found in the Message #87

Open VsDims opened 10 months ago

VsDims commented 10 months ago

Here is such an error occurs when running ipfixcol2 -c ipfix.cfg how to fix it?

WARNING: UDP input (parser): [12.1.24.1:58633, ODID: 256] Number of records in NetFlow v9 Message header doesn't match number of records found in the Message (expected: 1, found: 0) WARNING: UDP input (parser): [12.1.24.1:58633, ODID: 256] Unable to convert NetFlow v9 Data Set (FlowSet ID: 256) to IPFIX due to missing NetFlow template. The Data FlowSet and its records will be dropped!

Lukas955 commented 10 months ago

Hi,

This occurs when the collector is started later than the flow data exporter (i.e. flow probe/router). When using UDP transmission, the so-called NetFlow/IPFIX templates that describe the structure of the flow records are sent at the beginning of the communication and at regular intervals (usually configurable on the flow exporter). Since the collector was started later, it did not have the opportunity to see the initial templates and is therefore temporarily unable to interpret the data, and therefore generates warnings. However, this problem resolves itself when the flow exporter resends the templates.

In other words, just wait a little while and the problem should resolve itself. Unfortunately, this is a "feature" of both NetFlow and IPFIX protocols when transmitted over UDP.

Lukas