Got it

netstream flow problem huawei ne40

Latest reply: Jan 8, 2020 12:53:41 587 2 0 0 0

Dear, I have a problem to export flow from a huawei ne40, I tried anyway and the datagrams apparently do not arrive correctly on the server, below is the configuration and form that arrives on the server through tcpdump collection.


ip netstream export version 5 origin-as

ip netstream export index-switch 32

ip netstream as-mode 32

ip netstream timeout active 1

ip netstream timeout inactive 15

ip netstream export template timeout-rate 2

ip netstream export template option sampler

ip netstream export template option timeout-rate 1

ip netstream export template option application-label

ip netstream sampler random-packets 10000 inbound

ip netstream sampler random-packets 2048 outbound

ip netstream export source xxx.xxx.xxx.xxx

ip netstream export host yyy.yyy.yyy.yyy 9000

ipv6 netstream export version 9

ipv6 netstream export index-switch 32

ipv6 netstream as-mode 32

ipv6 netstream timeout inactive 15

ipv6 netstream export template timeout-rate 1

ipv6 netstream export template option sampler

ipv6 netstream export template option timeout-rate 1

ipv6 netstream export source xxx.xxx.xxx.xxx

ipv6 netstream export host yyy.yyy.yyy.yyy 9000

ip netstream aggregation as

 enable

 template timeout-rate 2

 ip netstream export source xxx.xxx.xxx.xxx

 ip netstream export host yyy.yyy.yyy.yyy 9000

ip netstream aggregation source-prefix-tos

 enable

 ip netstream export source xxx.xxx.xxx.xxx

 ip netstream export host yyy.yyy.yyy.yyy 9000

slot 3

interface GigabitEthernet0/3/3

 ip netstream inbound

 ip netstream outbound

interface GigabitEthernet0/3/3.10

 ip netstream inbound

 ip netstream outbound

slot

 slot 3:ip netstream sampler to slot self

 slot 3:ip netstream export host yyy.yyy.yyy.yyy 9000

 slot 3:ipv6 netstream sampler to slot self


tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes

09:23:27.670896 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto UDP (17), length 1412)

    xxx.xxx.xxx.xxx.40000 > xxx.xxx.xxx.xxx.9000: [no cksum] UDP, length 1384

09:23:27.680866 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto UDP (17), length 1412)

    xxx.xxx.xxx.xxx.40000 > xxx.xxx.xxx.xxx.9000: [no cksum] UDP, length 1384

09:23:27.685815 IP (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto UDP (17), length 1412)


thanks

@user_3169773 hello,
sorry but I'm not sure your problem. Would you please specify your problem more detailedly?
View more
  • x
  • convention:

thanks for the answer, what happens is as follows, I set up netstream in every way possible on 2 huawei ne20 and ne40 routers and the datagrams do not arrive correctly on the server, arrive several equal packets on the server but do not identify as flow, I used as-stats scripts and nfdump tool, below capture example:
nfcapd -E -p 2055 -l / tmp / nfcap-test
nfdump -r /tmp/nfcap-test/nfcapd.202001072123 -s srcip / bytes
nfdump -r /tmp/nfcap-test/nfcapd.202001071857 -s srcip / bytes
No matched flows

root@as-stats:~# tcpdump -n dst port 2055 -vv
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
09:45:50.680342 IP (tos 0x0, ttl 255, id 34553, offset 0, flags [none], proto UDP (17), length 1460)
yyy.yyy.yyy.yyy.40000 > yyy.yyy.yyy.yyy.2055: [no cksum] UDP, length 1432
09:45:50.820350 IP (tos 0x0, ttl 255, id 34554, offset 0, flags [none], proto UDP (17), length 1460)
yyy.yyy.yyy.yyy.40000 > yyy.yyy.yyy.yyy.2055: [no cksum] UDP, length 1432
09:45:50.910376 IP (tos 0x0, ttl 255, id 34555, offset 0, flags [none], proto UDP (17), length 1460)
yyy.yyy.yyy.yyy.40000 > yyy.yyy.yyy.yyy.2055: [no cksum] UDP, length 1432
09:45:50.970354 IP (tos 0x0, ttl 255, id 34556, offset 0, flags [none], proto UDP (17), length 1460)
yyy.yyy.yyy.yyy.40000 > yyy.yyy.yyy.yyy.2055: [no cksum] UDP, length 1432
09:45:51.030330 IP (tos 0x0, ttl 255, id 34557, offset 0, flags [none], proto UDP (17), length 1460)
yyy.yyy.yyy.yyy.40000 > yyy.yyy.yyy.yyy.2055: [no cksum] UDP, length 1432
09:45:51.600316 IP (tos 0x0, ttl 255, id 34558, offset 0, flags [none], proto UDP (17), length 1460)
yyy.yyy.yyy.yyy.40000 > yyy.yyy.yyy.yyy.2055: [no cksum] UDP, length 1432
09:45:51.720324 IP (tos 0x0, ttl 255, id 34559, offset 0, flags [none], proto UDP (17), length 1460)
yyy.yyy.yyy.yyy.40000 > yyy.yyy.yyy.yyy.2055: [no cksum] UDP, length 1432
09:45:51.870329 IP (tos 0x0, ttl 255, id 34560, offset 0, flags [none], proto UDP (17), length 1460)
yyy.yyy.yyy.yyy.40000 > yyy.yyy.yyy.yyy.2055: [no cksum] UDP, length 1432
09:45:51.950329 IP (tos 0x0, ttl 255, id 34561, offset 0, flags [none], proto UDP (17), length 1460)
yyy.yyy.yyy.yyy.40000 > yyy.yyy.yyy.yyy.2055: [no cksum] UDP, length 1432
09:45:51.980346 IP (tos 0x0, ttl 255, id 34562, offset 0, flags [none], proto UDP (17), length 1460)
yyy.yyy.yyy.yyy.40000 > yyy.yyy.yyy.yyy.2055: [no cksum] UDP, length 1432
09:45:52.060345 IP (tos 0x0, ttl 255, id 34563, offset 0, flags [none], proto UDP (17), length 1460)
yyy.yyy.yyy.yyy.40000 > yyy.yyy.yyy.yyy.2055: [no cksum] UDP, length 1432

follows ne20 configuration

system
ip netstream export version 9
ip netstream as-mode 32
ip netstream timeout active 1
ip netstream timeout inactive 15
ip netstream tcp-flag enable
ip netstream export template option sampler
ip netstream export template option timeout-rate 1
ip netstream sampler fix-packets 500 inbound
ip netstream sampler fix-packets 500 outbound
ip netstream export source yyy.yyy.yyy.yyy
ip netstream monitor UP1
ip netstream export host yyy.yyy.yyy.yyy 2055

slot 0
interface Eth-Trunk0
ip netstream inbound
interface Eth-Trunk0.627
ip netstream inbound
ip netstream outbound
ip netstream monitor UP1 inbound
ip netstream monitor UP1 outbound
ip netstream sampler fix-packets 1000 inbound
slot
slot 3:ip netstream sampler to slot self

in surveys it seems that packages should come up with something like this:
08:27:46.969196 IP (tos 0x0, ttl 254, id 7276, offset 0, flags [none], proto UDP (17), length 84)
Z.Z.Z.Z.56848 > Y.Y.Y.Y.9000: [udp sum ok] UDP, length 56
in this example is a flow from a cisco router
View more
  • x
  • convention:

Comment

You need to log in to comment to the post Login | Register
Comment

Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:
  • Politically sensitive content
  • Content concerning pornography, gambling, and drug abuse
  • Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy
Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see " User Agreement."

My Followers

Login and enjoy all the member benefits

Login

Block
Are you sure to block this user?
Users on your blacklist cannot comment on your post,cannot mention you, cannot send you private messages.
Reminder
Please bind your phone number to obtain invitation bonus.