Skip to content

ipt_netflow Issue on Ubuntu 18: Nat Events Missing  #226

Open
@prometheus84

Description

@prometheus84

I am encountering a problem with ipt_netflow on Ubuntu 18, specifically related to missing Nat Events (NEL) in the collector logs. Here are the details of the current setup:

ipt_netflow Version: 2.6-7-g6a55739-dirty, srcversion D6E46E03E30B41A550C3B15
Protocol Version: 9 (netflow)
Refresh Rate: 20, Timeout Rate: 30
Templates: 4 (active 4)
Timeouts: Active 1800s, Inactive 15s, Maxflows 0
Natevents: Enabled, count start 338, stop 340
We are exclusively capturing Nat Events and not traffic flow. The collector being used is Netelastic. The issue at hand is that some Nat Events are not being recorded in the collector logs. Upon checking the exported conntrack, the events are observed as established. However, these events are not exported to the collector, and even after waiting for approximately 30 minutes, there is no log of these events in the collector.

It's important to note that this problem occurs randomly - some events are captured while others are missed. Any insights or solutions to address this inconsistency and ensure that all Nat Events are consistently captured and logged in the collector would be greatly appreciated.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions