Couldn't get flow in nfsen from CumulusVX

  • 1
  • Question
  • Updated 2 years ago

I have configured hsflowd in CumulusVX as below and also configured nfsen to get the flows. I am able to get flows from Other vendors in same nfsen but not from Cumulus. The Services are running fine on both Cumulus and nfsen. Port 6343 used for this setup and it is also listening to sfcapd service. Below are my settings:

cat /etc/hsflowd.conf

sflow{  DNSSD = off
  agent = swp1
  polling = 20
  sampling = 512
   ip = <IP of Nfsen Server>
   udpport = 6343

Nfsen Server:

%sources = (       
        'CumulusVX'    => { 'port' => '6343', 'col' => '#0000ff', 'type' => 'sflow' },


Logs in Nfsen Server:
 localhost nfcapd[14112]: Ident: 'CumulusVX' Flows: 0, Packets: 0, Bytes: 0, Sequence Errors: 0, localhost nfcapd[14112]: Total ignored packets: 0
Photo of Sushil Karki

Sushil Karki

  • 260 Points 250 badge 2x thumb

Posted 2 years ago

  • 1
Photo of Scott Suehle

Scott Suehle, Alum

  • 3,772 Points 3k badge 2x thumb

I would recommend opening a ticket with support for this. Let me know if that does not work for you and we can dive deeper on this.


Photo of Peter Phaal

Peter Phaal

  • 162 Points 100 badge 2x thumb

The following command is needed on CumulusVX to enable sFlow traffic monitoring:

sudo iptables -I FORWARD -j NFLOG --nflog-group 1 --nflog-prefix SFLOW

On physical switches the sFlow agent automatically configures packet sampling in the ASIC and is able to monitor all packets (not just the routed packets captured by the iptables command above).