[netsa-tools-discuss] Fwd: silk

[Daniel Hermans]

Hi SiLK team,

I'm trying to get SILK to ingest netflow v9 flows and having some issues as
can be seen by the logs below (with the template shown):

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]: Will process template
0x0101 with the YAF template

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]: Domain 0X0001,
TemplateID 0X0101, Contains 8 Elements, Enabled by
SILK_IPFIX_PRINT_TEMPLATES

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]: Domain 0X0001,
TemplateID 0X0101, Position   0, Length     4, IE           8, Name
sourceIPv4Address

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]: Domain 0X0001,
TemplateID 0X0101, Position   1, Length     4, IE          12, Name
destinationIPv4Address

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]: Domain 0X0001,
TemplateID 0X0101, Position   2, Length     4, IE          10, Name
ingressInterface

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]: Domain 0X0001,
TemplateID 0X0101, Position   3, Length     4, IE          14, Name
egressInterface

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]: Domain 0X0001,
TemplateID 0X0101, Position   4, Length     2, IE           7, Name
sourceTransportPort

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]: Domain 0X0001,
TemplateID 0X0101, Position   5, Length     2, IE          11, Name
destinationTransportPort

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]: Domain 0X0001,
TemplateID 0X0101, Position   6, Length     1, IE           4, Name
protocolIdentifier

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]: Domain 0X0001,
TemplateID 0X0101, Position   7, Length     4, IE           1, Name
octetDeltaCount

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]:
IGNORED|10.39.252.91|10.39.132.10|51702|25|6|0|344|byte or packet count is
zero|

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]:
IGNORED|10.39.39.221|10.11.40.143|8089|26286|6|0|7173|byte or packet count
is zero|

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]:
IGNORED|10.39.133.138|10.39.248.145|25|16976|6|0|566|byte or packet count
is zero|

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]:
IGNORED|10.39.181.67|10.39.145.255|31055|443|6|0|2107|byte or packet count
is zero|

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]:
IGNORED|10.39.39.221|10.40.29.69|8089|62069|6|0|6970|byte or packet count
is zero|

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]:
IGNORED|10.39.38.4|10.11.40.233|8089|29179|6|0|6021|byte or packet count is
zero|

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]:
IGNORED|10.39.39.46|10.108.10.84|58492|80|6|0|551|byte or packet count is
zero|

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]:
IGNORED|10.39.39.120|10.40.28.248|9997|50238|6|0|12292|byte or packet count
is zero|

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]:
IGNORED|10.39.38.4|10.11.40.40|8089|33242|6|0|6125|byte or packet count is
zero|

Dec 12 14:47:27 ip-10-39-128-243 rwflowpack[4370]:
IGNORED|10.39.132.10|10.39.252.91|25|51702|6|0|566|byte or packet count is
zero|





So all messages are ignored. A typical flow record as seen in wireshark
looks like:

Flow 1

    SrcAddr: 10.39.154.46

    DstAddr: 10.108.162.144

    InputInt: 133

    OutputInt: 0

    SrcPort: 443

    DstPort: 51769

    Protocol: TCP (6)

    Octets: 83026




Any thoughts as to what I'm doing wrong?

I don't actually know the model number of Cisco device(s) sending the flow
( the flows are sent from a service provider )  but i believe it's a Nexus
9K


My sensor and silk configs are small and simple - 1 sensor, 1 v9 flow etc..


I'm rusty on C but tried to enable TRACE mode based on a post I saw on the
archive list.


Didn't get too far with that either, as when I compile libfixbuf-1.8.0 it
installs the shared object /usr/local/lib/libfixbuf.so.3.2.0 rather than
/usr/local/lib/libfixbuf.so.1.8.0


The  silk-3.16.0 configure then does not find the shared object and doesn't
enable netflow support ( fails the version check )




Thanks for any help!
-------------- next part --------------
HTML attachment scrubbed and removed