I am trying to figure out why I cannot run nfsen with a single UDP for all my devices that are sending netflow data. I have read that is is possible with nfcapd version 1.6 or higher.
Currently installed:
nfdump: Version: NSEL-NEL1.6.17
nfcapd: Version: 1.6.17
nfsen: Version: 1.3.8
This is an example of how I have it setup in nfsen.conf
%sources = (
‘router1’ => { ‘port’ => ‘9995’, ‘IP’ => ‘192.168.1.2’, ‘col’ => ‘#0000ff’, ‘type’ => ‘netflow’ },
‘router2’ => { ‘port’ => ‘9995’, ‘IP’ => ‘192.168.1.3’, ‘col’ => ‘#00ff00’, ‘type’ => ‘netflow’ },
‘switch1’ => { ‘port’ => ‘9995’, ‘IP’ => ‘192.168.1.4’, ‘col’ => ‘#ff0000’, ‘type’ => ‘netflow’ },
);
After I save the config and try to start nfsen i get the following error.
Starting nfcapd:(router1 router2 switch1): collector did not start - see logfile
If I set different ports for each device I am seeing the flows show up. I have roughly 400 devices I need to capture the netflows form and using different ports for each device is problematic for managing it.
Can someone please let me know what I am missing or doing wrong here? I have read multiple places this was address in nfcapd version 1.6 and newer but it doesn’t seem to work for me.
Thank you so much for any advice you might have to help me resolve this.