You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'm trying to get softflowd to ship netflow from pfSense and am not seeing any of the traffic. I've looked at both #11487 and #11514 as those issues looked similar, however I'm not having any luck. I've also dug into the Firewall section in the documentation.
1.) I've created the custom host and port groups (customhostgroup0/customportgroup0:2055)
2.) I've added "custumportgroup0" to 'firewall -> role -> sensor -> chain -> INPUT -> customhostgroup0 -> portgroups'
3.) Added the "NetFlow Records Integration" to Fleet under the "so-grid-nodes_general" agent policy and set the UDP host to 0.0.0.0 (tried the IP for the sensor as well) --- I also tried to change the namespace to match what the other integrations had.
4.) Querying for "event.dataset:netflow.log" comes up empty.
One thing I did notice when I ran a netstat -tunlp is that ports 514 and 2055 appear to be listening on IPv6 only? I do have syslog setup and am receiving traffic there so I'm kind of confused. Is that possibly my issue?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
-
I'm trying to get softflowd to ship netflow from pfSense and am not seeing any of the traffic. I've looked at both #11487 and #11514 as those issues looked similar, however I'm not having any luck. I've also dug into the Firewall section in the documentation.
1.) I've created the custom host and port groups (customhostgroup0/customportgroup0:2055)
2.) I've added "custumportgroup0" to 'firewall -> role -> sensor -> chain -> INPUT -> customhostgroup0 -> portgroups'
3.) Added the "NetFlow Records Integration" to Fleet under the "so-grid-nodes_general" agent policy and set the UDP host to 0.0.0.0 (tried the IP for the sensor as well) --- I also tried to change the namespace to match what the other integrations had.
4.) Querying for "event.dataset:netflow.log" comes up empty.
One thing I did notice when I ran a
netstat -tunlp
is that ports 514 and 2055 appear to be listening on IPv6 only? I do have syslog setup and am receiving traffic there so I'm kind of confused. Is that possibly my issue?Any thoughts?
Beta Was this translation helpful? Give feedback.
All reactions