Hi all,
I was trying to receive ipfix from YAF (Yet Another Flowmeter). I changed the yaf config to udp and I thought I would receive events perfectly. But, YAF says in the log file that the connection is refused! However, I have defined the datainput to receive IPFIX on the default 4739 port and it is listening perfectly.
Please help me on this.
Thanks a lot
here's another option: http://docs.splunk.com/Documentation/StreamApp/7.0.1/DeployStreamApp/ConfigureFlowcollector
I managed to solve the problem by inputting the server ip instead of localhost on the yaf config. However, I can't receive application labels and other deep packet information on the index.
Is there any approach for receiving all the information that yaf can provide?