<html><body><div class="MV0LWFC-fd-a" style="margin: 0px 0px 0px 44px; padding: 0px 0px 0px 5px; border: 0px; vertical-align: baseline;"><div tabindex="0" class="MV0LWFC-nb-P" style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline; color: rgb(34, 34, 34); line-height: normal;"><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline; overflow: auto;"><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline; max-height: 10000px;"><div dir="ltr" style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;">Firstly please excuse me if i've posted in the wrong group, i was trying to find a softflowd group/mailing list and I'm hoping someone here can help answer this question</div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><br></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;">I have an Amazon Linux instance running some Ipsec and OpevnVPN tunnels which has Cacti running, Im graphing bandwidth usage and such</div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><br></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;">One thing I specifically wanted to do is use a Linux based NetFlow agent to capture the traffic and graph it using the FlowTools plugin in Cacti, so I installed/configured softflowd and have it running </div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;">by default on UDP port 9995. </div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><br></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;">According to the instructions and several wiki's i've read, it says it should be possible to run 'tcpump udp port 9995' on the box and see the traffic however when I do this i see nothing at all. (even though I've got a firewall rule which allows localhost to connect to 9995/udp .</div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><br></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;">When I run 'softflowctl statistics' I see this </div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><br></div><blockquote style="margin: 0px 0px 0px 40px; border: none; padding-right: 0px; padding-bottom: 0px; padding-left: 0px;"><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;">root@ip-10-99-0-240:~/<wbr>softflowd# softflowctl statistics</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;">softflowd[4098]: Accumulated statistics since 2015-05-06T16:24:29 UTC:</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;">Number of active flows: 22</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;">Packets processed: 36748981</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;">Fragments: 0</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;">Ignored packets: 15762 (15762 non-IP, 0 too short)</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;">Flows expired: 2271 (0 forced)</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;">Flows exported: 4265 in 1094 packets (0 failures)</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;">Packets received by libpcap: 38124167</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;">Packets dropped by libpcap: 1359404</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;">Packets dropped by interface: 0</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;"><br></p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;">Expired flow statistics: minimum average maximum</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;"> Flow bytes: 40 15330798 2255120641</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;"> Flow packets: 1 15660 2663741</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;"> Duration: 0.00s 221.36s 51087.61s</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;"><br></p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;">Expired flow reasons:</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;"> tcp = 20 tcp.rst = 54 tcp.fin = 890</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;"> udp = 1292 icmp = 3 general = 0</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;"> maxlife = 0</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;">over 2 GiB = 12</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;"> maxflows = 0</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;"> flushed = 0</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;"><br></p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;">Per-protocol statistics: Octets Packets Avg Life Max Life</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;"> Unknown (1): 7576 135 17.93s 34.04s</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;"> Unknown (6): 22597666810 21903315 309.84s 30485.42s</p></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;"> Unknown (17): 12218568662 13659551 155.59s 51087.61s</p></div></blockquote><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;"><br>Ive never done this stuff before and my total understanding is that this isn't working because the host is a Citrix Xen based VM with virtual switch implementation and no capability to mirror ports ? I've got the FlowView Cacti plugin installed on my host and am using the FlowCapture .deb package on the same host to pickup the softflowd/netflow v5 messages but nothing seems to be generated and im not seeing anything.</p><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;">I've spoken to Amazon AWS support and they know nothing about netflow/softflowd.</p><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;">Has anyone else had a similar experience or knowledge of AWS and softflowd ?</p><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;"><br></p><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;">thanks in advance.</p><p style="padding: 0px; border: 0px; vertical-align: baseline; margin: 1em 0px; font-size: 13px;"></p></div></div></div></div></div></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"></div></div><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><div class="MV0LWFC-fd-a" style="margin: 0px 0px 0px 44px; padding: 0px 0px 0px 5px; border: 0px; vertical-align: baseline;"></div></div><div class="MV0LWFC-nb-b" style="margin-top: 0px; margin-right: 0px !important; margin-bottom: 0px; margin-left: 39px; padding: 0px 0px 0px 5px; border: 0px; vertical-align: baseline;"><div class="MV0LWFC-nb-a MV0LWFC-nb-cb" style="margin: 0px; padding: 4px 0px; border: 0px; vertical-align: baseline; position: relative;"><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline;"><div style="margin: 0px; padding: 0px; border: 0px; vertical-align: baseline; color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: 13px; line-height: normal; display: inline-block;"></div><span style="color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: 13px; line-height: normal;"></span><div class="MV0LWFC-nd-a" style="margin: 4px 0px 0px; padding: 0px; border: 0px; vertical-align: baseline; position: relative; height: 34px; color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size: 13px; line-height: normal;">Dan. </div></div></div></div></body></html>