Splunk Add-on for Netflow - "no matched flows"?? events displayed only

[pmeyerson]

I'm trying to get the Netflow Add-On (https://splunkbase.splunk.com/app/1658/) working on my test splunk server first. Linux x64 system. Sending equipment is cisco asa netflow v9.

I ran configure.sh, and I do see traffic comming in on the port and splunk is listening on the port.
However the only events I see in the netflow index are "No matched flows" logged every 2 mins.... what does this mean? I'm not seeing any hints in local splunkd.log

zzadmin@zzsplunk:/opt/splunk/etc/apps/Splunk_TA_flowfix/bin$ netstat -ano |grep aaa
udp 0 0 0.0.0.0:aaa 0.0.0.0:* off (0.00/0/0)

zzadmin@zzsplunk:/opt/splunk/etc/apps/Splunk_TA_flowfix/bin$ ps -ef | grep aaa
splunk 19663 1 0 16:08 ? 00:00:00 /opt/splunk/etc/apps/Splunk_TA_flowfix/bin/Linux_x86_64_core2/nfcapd -p aaa -T all -t 120 -l /opt/splunk/etc/apps/Splunk_TA_flowfix/nfdump-binary/aaa -P /opt/splunk/etc/apps/Splunk_TA_flowfix/bin/nfcapd-1-v9--aaa.pid -D

zzadmin@zzsplunk:/opt/splunk/etc/apps/Splunk_TA_flowfix/bin$ sudo tcpdump -i ens192 -v "port aaa"
tcpdump: listening on ens192, link-type EN10MB (Ethernet), capture size 262144 bytes
16:37:00.974889 IP (tos 0x0, ttl 253, id 41940, offset 0, flags [none], proto UDP (17), length 1444)
host.zz > splunk.aaa: UDP, length 1416

I see the nfdump-binary nfcapd* are each only 276 bytes. Nothing in nfdump-ascii.

Thanks for any suggestions.

[mayurr98]

hey @pmeyerson

Use this app https://splunkbase.splunk.com/app/489/
The one you specified doesn't work properly. I was facing the same issue. I have worked on NetFlow and able to see logs through this app. You might have to install NetFlow integrator which is a third party tool which is free for 60 days. So you can give it a try.

[erickyi · Accepted solution]

from the doco, it is supporting only NetFlow versions 5 and 7, with limited IPFIX headers support for NetFlow version 9. probably this is the reason. try to configure cisco to send the older format (v5 or v7) and see if it works.
fyi, we have used another splunk add-on (1838: Technology add on for netflow) successfully

good luck

[pmeyerson]

did you have to buy Netflow Logic's NFO product to get this add-on (1838) to work? Or did you just point your netflow source as splunk and the TA did its thing? Thanks.

[erickyi]

sorry for the late reply. weekend break. we did have NFO as it is for built for a security system for an australian government body.
how about this to test v5, v9 format to eliminate whether it is format issue? Download flowalyzer (from plizer) - it is free and easy to setup.
Start flowanalyzer
Select Generator
In the Collector box,
* select Netflow v5 in the version.
* enter the ip address of your splunk server
* enter the UDP port

Specify the src_ip, dst_ip (could be dummy) and then press the Start button.

I tried to attach a picture for you but failed. Hope this tool will help to identify your issue (one step closer)

[pmeyerson]

Wow, i tried generating the default flow with this generator tool and that is not being picked up either. I tried running the configuration script again but that didnt help... guess i need to move to the app with the purchase required or the stream app support mentioned. Appreciate all your suggestions.

[erickyi]

curious. did u do a tcpdump at your server end to make sure the traffic is coming? can u paste your inputs.conf? see if we can spot anything obvious. good luck

[pmeyerson]

Thats a great suggestion, thanks very much.