Home
Help
Search
Login
Register
OPNsense Forum
»
English Forums
»
General Discussion
»
Missing MAC addresses in NetFlow exports
« previous
next »
Print
Pages: [
1
]
Author
Topic: Missing MAC addresses in NetFlow exports (Read 3100 times)
marianh
Newbie
Posts: 5
Karma: 0
Missing MAC addresses in NetFlow exports
«
on:
June 28, 2017, 09:26:59 am »
Version of OPNsense 16.7.
Problem: cannot find source MAC and destination MAC in NetFlow exports.
Suggested solution: add mac address fields (IN_SRC_MAC, OUT_DST_MAC) in NetFlow v9 template.
Packet capture of the export:
Cisco NetFlow/IPFIX
Version: 9
Count: 23
SysUptime: 1118038.000000000 seconds
Timestamp: Jun 28, 2017 09:14:14.000000000 Central Europe Daylight Time
FlowSequence: 11277
SourceId: 0
FlowSet 1 [id=256] (10 flows)
FlowSet Id: (Data) (256)
FlowSet Length: 576
[Template Frame: 1]
Flow 1
SrcAddr: 10.100.1.70
DstAddr: 10.100.0.1
NextHop: 130.41.41.199
InputInt: 2
OutputInt: 7
Packets: 1
Octets: 63
Post Packets: 0
Post Octets: 0
[Duration: 0.000000000 seconds (switched)]
StartTime: 1118016.000000000 seconds
EndTime: 1118016.000000000 seconds
SrcPort: 55738
DstPort: 53
TCP Flags: 0x00
00.. .... = Reserved: 0x0
..0. .... = URG: Not used
...0 .... = ACK: Not used
.... 0... = PSH: Not used
.... .0.. = RST: Not used
.... ..0. = SYN: Not used
.... ...0 = FIN: Not used
Protocol: UDP (17)
IP ToS: 0x00
SrcAS: 0
DstAS: 0
SrcMask: 16
DstMask: 32
Capture of sent Netflow template:
Cisco NetFlow/IPFIX
Version: 9
Count: 23
SysUptime: 1117945.000000000 seconds
Timestamp: Jun 28, 2017 09:12:41.000000000 Central Europe Daylight Time
FlowSequence: 11272
SourceId: 0
FlowSet 1 [id=0] (Data Template): 256,259
FlowSet Id: Data Template (V9) (0)
FlowSet Length: 172
Template (Id = 256, Count = 20)
Template Id: 256
Field Count: 20
Field (1/20): IP_SRC_ADDR
Field (2/20): IP_DST_ADDR
Field (3/20): IP_NEXT_HOP
Field (4/20): INPUT_SNMP
Field (5/20): OUTPUT_SNMP
Field (6/20): PKTS
Field (7/20): BYTES
Field (8/20): OUT_PKTS
Field (9/20): OUT_BYTES
Field (10/20): FIRST_SWITCHED
Field (11/20): LAST_SWITCHED
Field (12/20): L4_SRC_PORT
Field (13/20): L4_DST_PORT
Field (14/20): TCP_FLAGS
Field (15/20): PROTOCOL
Field (16/20): IP_TOS
Field (17/20): SRC_AS
Field (18/20): DST_AS
Field (19/20): SRC_MASK
Field (20/20): DST_MASK
«
Last Edit: June 28, 2017, 09:34:14 am by marianh
»
Logged
Print
Pages: [
1
]
« previous
next »
OPNsense Forum
»
English Forums
»
General Discussion
»
Missing MAC addresses in NetFlow exports