search

aabc / ipt-netflow

Netflow iptables module for Linux kernel (official)
https://github.com/aabc/ipt-netflow
502 stars 129 forks source link

ipt_netflow Issue on Ubuntu 18: Nat Events Missing #226

Open prometheus84 opened 7 months ago

prometheus84 commented 7 months ago

I am encountering a problem with ipt_netflow on Ubuntu 18, specifically related to missing Nat Events (NEL) in the collector logs. Here are the details of the current setup:

ipt_netflow Version: 2.6-7-g6a55739-dirty, srcversion D6E46E03E30B41A550C3B15 Protocol Version: 9 (netflow) Refresh Rate: 20, Timeout Rate: 30 Templates: 4 (active 4) Timeouts: Active 1800s, Inactive 15s, Maxflows 0 Natevents: Enabled, count start 338, stop 340 We are exclusively capturing Nat Events and not traffic flow. The collector being used is Netelastic. The issue at hand is that some Nat Events are not being recorded in the collector logs. Upon checking the exported conntrack, the events are observed as established. However, these events are not exported to the collector, and even after waiting for approximately 30 minutes, there is no log of these events in the collector.

It's important to note that this problem occurs randomly - some events are captured while others are missed. Any insights or solutions to address this inconsistency and ensure that all Nat Events are consistently captured and logged in the collector would be greatly appreciated.

prometheus84 commented 7 months ago

issue solved, after investigating that there was 9 hops, i reduced it to 1, now no issue