search

javadmohebbi / goNfCollector

A set of tool to collect & analyze netflow & export them to many DBs & Apps like InfluxDB time-series DB
94 stars 20 forks source link

collector cant decode HPE Aruba sflow records #39

Closed merewind closed 1 year ago

merewind commented 1 year ago

2022-12-16 09:57:24 ERROR[2022-12-16T14:57:24Z] File: collector.go Function: github.com/goNfCollector/collector.(Collector).collect Line: 356 [6]-Can not decode netflow data: (netflow: unsupported version 0) debug="File: collector.go Function: github.com/goNfCollector/collector.(Collector).collect Line: 356"

merewind commented 1 year ago

any ideas how to address this

javadmohebbi commented 1 year ago

Hi @merewind

It seems that your netflow exported from your device is not supported by this solution. to be sure, please do the following and let me have the output.

1- You need to stop the netflow collector docker images

cd $HOME/oi24/nfcollector
docker-compose down

2- Download the following logger tool and run int, wait form some minutes and after that, a file located in /tmp/nfcollector-dump.log (by default) will be created. You can change it using -out /path/to/your/log/file. Also if you are listening on different address other than default port :6859, you can change it using -addr command line option. 

wget -O /tmp/nfcollector-logger https://github.com/javadmohebbi/goNfCollector/raw/main/build/linux/amd64/nfcollector-logger
chmod +x /tmp/nfcollector-logger
sudo /tmp/nfcollector-logger

This file might include some confidential information like IP addresses, You can replace the confidential IP Addresses and the share it with me.

javadmohebbi commented 1 year ago

@merewind Also let me know the device your are going to export netflow from?

merewind commented 1 year ago

Hi Javad, for some reason the dump file is empty and I'm getting these errors:

2022/12/20 10:37:19 Creating log file in this path: /tmp/nfcollector-dump.log 2022/12/20 10:37:19 received 384 bytes from 10.1.6.248:57384 2022/12/20 10:37:19 decoder error: netflow: unsupported version 0 2022/12/20 10:37:19 received 1084 bytes from 10.1.6.248:57384 2022/12/20 10:37:19 decoder error: netflow: unsupported version 0 2022/12/20 10:37:19 received 1224 bytes from 10.1.6.248:57384 2022/12/20 10:37:19 decoder error: netflow: unsupported version 0 2022/12/20 10:37:20 received 1224 bytes from 10.1.6.248:57384 2022/12/20 10:37:20 decoder error: netflow: unsupported version 0 2022/12/20 10:37:20 received 432 bytes from 10.1.6.248:57384 2022/12/20 10:37:20 decoder error: netflow: unsupported version 0 2022/12/20 10:37:20 received 1260 bytes from 10.1.6.248:57384 2022/12/20 10:37:20 decoder error: netflow: unsupported version 0 2022/12/20 10:37:21 received 1396 bytes from 10.1.6.248:57384 2022/12/20 10:37:21 decoder error: netflow: unsupported version 0 2022/12/20 10:37:21 received 1240 bytes from 10.1.6.248:57384 2022/12/20 10:37:21 decoder error: netflow: unsupported version 0 2022/12/20 10:37:21 received 1232 bytes from 10.1.6.248:57384 2022/12/20 10:37:21 decoder error: netflow: unsupported version 0 2022/12/20 10:37:22 received 1364 bytes from 10.1.6.248:57384 2022/12/20 10:37:22 decoder error: netflow: unsupported version 0

On Mon, Dec 19, 2022 at 10:07 PM M. Javad Mohebbi @.***> wrote:

Hi @merewind https://github.com/merewind

It seems that your netflow exported from your device is not supported by this solution. to be sure, please do the following and let me have the output.

1- You need to stop the netflow collector docker images

cd $HOME/oi24/nfcollector docker-compose down

2- Download the following logger tool and run int, wait form some minutes and after that, a file located in /tmp/nfcollector-dump.log (by default) will be created. You can change it using -out /path/to/your/log/file. Also if you are listening on different address other than default port :6859, you can change it using -addr command line option.

wget -O /tmp/nfcollector-logger https://github.com/javadmohebbi/goNfCollector/raw/main/build/linux/amd64/nfcollector-logger chmod +x /tmp/nfcollector-logger sudo /tmp/nfcollector-logger

This file might include some confidential information like IP addresses, You can replace the confidential IP Addresses and the share it with me.

— Reply to this email directly, view it on GitHub https://github.com/javadmohebbi/goNfCollector/issues/39#issuecomment-1358778795, or unsubscribe https://github.com/notifications/unsubscribe-auth/AGCNWCREYMFQCUYZPACQ2QDWOEPINANCNFSM6AAAAAATBCBUCI . You are receiving this because you were mentioned.Message ID: @.***>

merewind commented 1 year ago

turns out HPE switches are not supported by the collector..