natevents is not working !!
ipt_NETFLOW 2.1, srcversion 89556420DEF91883C3D504B; dir mac nel
Protocol version 9 (netflow), refresh-rate 20, timeout-rate 30, (templates 8, active 8).
Timeouts: active 15s, inactive 15s. Maxflows 2000000
Natevents enabled, count start 0, stop 0.
Flows: active 0 (peak 133 reached 0d0h46m ago), mem 625K, worker delay 100/1000 [1..100] (48 ms, 0 us, 0:0 [cpu0]).
Hash: size 160000 (mem 625K), metric 1.00 [1.00, 1.00, 1.00]. InHash: 0 pkt, 0 K, InPDU 0, 0.
Rate: 0 bits/sec, 0 packets/sec; Avg 1 min: 58 bps, 0 pps; 5 min: 522 bps, 0 pps
cpu# pps; <search found="" new="" <span="">[metric], trunc frag alloc maxflows>, traffic: <pkt, bytes="">, drop: <pkt, bytes="">
Total 0; 0 3115 770 [1.00], 0 0 0 0, traffic: 3885, 1 MB, drop: 0, 0 K
cpu0 0; 0 0 0 [1.00], 0 0 0 0, traffic: 0, 0 MB, drop: 0, 0 K
cpu1 0; 0 1695 392 [1.00], 0 0 0 0, traffic: 2087, 0 MB, drop: 0, 0 K
cpu2 0; 0 1420 378 [1.00], 0 0 0 0, traffic: 1798, 1 MB, drop: 0, 0 K
cpu3 0; 0 0 0 [1.00], 0 0 0 0, traffic: 0, 0 MB, drop: 0, 0 K
Export: Rate 0 bytes/s; Total 98 pkts, 0 MB, 770 flows; Errors 0 pkts; Traffic lost 0 pkts, 0 Kbytes, 0 flows.
sock0: 192.168.71.231:2000, sndbuf 110592, filled 0, peak 1692; err: sndbuf reached 0, connect 0, cberr 3, other 0
Natevents enabled, count start 0, stop 0. << count always is 0.
my kernel : 2.6.30
iptables :1.4.10
i have enable natevents in configure.
in my nfdump can't see any information too .
Is any too can help Troubleshooting?
Does this server perform nat translation or it's performed on other server?
Is in this server perform nat .
And i have enable IMQ, pppoe-server in this server .
Can you install conntrack-tools (you may have it in your distro), then run
conntrack -E
and observe if there is events going on.After install contract-tools
this is the message
[NEW] icmp 1 30 src=172.17.16.36 dst=211.28.128.5 type=8 code=0 id=1 [UNREPLIED] src=211.28.128.5 dst=43.129.46.11 type=0 code=0 id=1
[UPDATE] icmp 1 30 src=172.17.16.36 dst=211.28.128.5 type=8 code=0 id=1 src=211.28.128.5 dst=43.129.46.11 type=0 code=0 id=1
[DESTROY] icmp 1 src=172.17.16.36 dst=211.28.128.5 type=8 code=0 id=1 packets=1 bytes=60 src=211.28.128.5 dst=43.129.46.11 type=0 code=0 id=1 packets=1 bytes=60
my distro is Fedora 11
also i have update package as below
libnfnetlink
libmnl
libnetfilter_conntrack-1.0.4
libnetfilter_queue-1.0.2.tar.bz2
libnetfilter_cttimeout-1.0.0
libnetfilter_cthelper-1.0.0.tar
But when i reboot , conntrack -E will not display any message , before i run iptstate.
ipt_NETFLOW 2.1, srcversion 89556420DEF91883C3D504B; dir mac nel
Protocol version 9 (netflow), refresh-rate 20, timeout-rate 30, (templates 26, active 9).
Timeouts: active 15s, inactive 15s. Maxflows 2000000
Natevents enabled, count start 0, stop 0.
Flows: active 116 (peak 358 reached 0d0h16m ago), mem 640K, worker delay 100/1000 [1..100] (86 ms, 0 us, 93:0 [cpu2]).
Natevents counter still 0
Thanks! This is rather strange. I will think about it.
I am give up for Fedora .
Right now use Centos 6 + ipt_netflow + nfsen+ nfdump
ipt_netflow and nat event is working
But in nfsen only some flow have show public ip address.
Look Like not send out every thing ?
ipt-netflow sends everything, but what is shown by nfsen I don't know. You may verify with wireshark capture of netflow traffic and check if missed data is there.
I think i ask wrong qustion.
I mean only Event CREATE / DELETE Will show nat ip address ,
but If event is INVALID will not show nat ip address.
I don't know what is "INVALID" event. There is no such events in netflow/nel. I think this may be problem of nfsen or, likely, your interpretation of nfsel output. You can analyze raw netflow packets with wireshark. Also, note that NEL flows does not report traffic counters, but your 'invalid' line contains 'In Byte' vith value '104'.
with ./configure --enable-natevents option, error message while compiling...
make -C /tmp/bering-uclibc/source/linux/linux-i686 M=/tmp/bering-uclibc/source/iptables/ipt-netflow-master modules CONFIG_DEBUG_INFO=y
make[2]: Entering directory
/tmp/bering-uclibc/source/linux/linux-i686' make -C /tmp/bering-uclibc/source/linux/linux-2.6.35.14 O=/tmp/bering-uclibc/source/linux/linux-i686/. modules /tmp/bering-uclibc/source/linux/linux-2.6.35.14/arch/x86/Makefile:81: stack protector enabled but no compiler support CC [M] /tmp/bering-uclibc/source/iptables/ipt-netflow-master/ipt_NETFLOW.o /tmp/bering-uclibc/source/iptables/ipt-netflow-master/ipt_NETFLOW.c: In function 'register_ct_events': /tmp/bering-uclibc/source/iptables/ipt-netflow-master/ipt_NETFLOW.c:5309: error: implicit declaration of function 'ref_module' /tmp/bering-uclibc/source/iptables/ipt-netflow-master/ipt_NETFLOW.c: In function 'ipt_netflow_init': /tmp/bering-uclibc/source/iptables/ipt-netflow-master/ipt_NETFLOW.c:5429: warning: format '%lu' expects type 'long unsigned int', but argument 3 has type 'unsigned int' make[5]: *** [/tmp/bering-uclibc/source/iptables/ipt-netflow-master/ipt_NETFLOW.o] Error 1 make[4]: *** [_module_/tmp/bering-uclibc/source/iptables/ipt-netflow-master] Error 2 make[3]: *** [sub-make] Error 2 make[2]: *** [all] Error 2 make[2]: Leaving directory
/tmp/bering-uclibc/source/linux/linux-i686'make[1]: *** [ipt_NETFLOW.ko] Error 2
make[1]: Leaving directory
/tmp/bering-uclibc/source/iptables/ipt-netflow-master' make: *** [ipt-netflow-master/.build] Error 1 make: Leaving directory
/tmp/bering-uclibc/source/iptables'without --enable-natevents option, it seems ok.
any ideas?
Last edit: pingping 2017-03-03