How to run flow view correctly?

[duwijakarta]

Hello, please help me, until now I have difficulty completing the flowview on the cacti that I use, what are the initial steps to ensure that the flowview is running correctly? I tried to attach some files, please help correct, are the flow view settings that I run correct? is the listener correct? is port 2055 open from the switch so that it can send data to the flowview server?

cacti version 1.2.29
Flowview version 4.8

[duwijakarta]

Hello, please help me, until now I have difficulty completing the flowview on the cacti that I use, what are the initial steps to ensure that the flowview is running correctly? I tried to attach some files, please help correct, are the flow view settings that I run correct? is the listener correct? is port 2055 open from the switch so that it can send data to the flowview server?

cacti version 1.2.29
Flowview version 4.8

and this is for the settings on the cacti/flowview server, is the flowview storage not yet available to receive data from the switch?

[macan]

show screenshot of Console -> Flowview -> listeners

[duwijakarta]

show screenshot of Console -> Flowview -> listeners

Here are the results, sir

[macan]

I have tested actual github develop branch and it works. Try to use version from https://github.com/Cacti/plugin_flowview from develop branch

[duwijakarta]

I have tested actual github develop branch and it works. Try to use version from https://github.com/Cacti/plugin_flowview from develop branch

I have tried following the steps from github, do I need to try uninstalling and then reinstalling according to the tutorial on YouTube? Or is there a possibility that the problem occurs in the data sending device such as my switch?
For my switch settings like this
Description: User defined
Export protocol: NetFlow Version 9
Transport Configuration:
Destination type: IP
Destination IP address: <ip server cacti>
Source IP address: <ip Device>
Transport Protocol: UDP
Destination Port: 2055
Source Port: 53771
DSCP: 0x0
TTL: 255
Output Features: Used

[macan]

You can try debug:
1) Disable all flow collectors
2) Go to console -> Flowview -> collectors -> edit your collector. You wil see in address id of collector (flowview_devices.php?action=edit&id=2)
3) run /path/to/php /path/to/cacti/plugins/flowview/flow_collector.php --debug --listener-id=YOUR_ID
4) you should see something like:

The buffer is 1236, The peer is 192.168.222.1
-----------------------------------------------
Flow: Sleep Time: 0.00
Flow: Packet from: 192.168.222.1 v9 - Len: 1236
Flow: Processing v9 Data, Records: 3
===============================================
Flow: Template Sets Found
Flow: Template Set Length: 1140
===============================================
Flow: Template Id: 258 with 21 fields
Flow: Name: octetDeltaCount, Id: 1, Length: 8, Type: unsigned64, Unpack: J
Flow: Name: postOctetDeltaCount, Id: 23, Length: 8, Type: unsigned64, Unpack: J
Flow: Name: packetDeltaCount, Id: 2, Length: 4, Type: unsigned64, Unpack: N
Flow: Name: postPacketDeltaCount, Id: 24, Length: 4, Type: unsigned64, Unpack: N
Flow: Name: flowStartSysUpTime, Id: 22, Length: 4, Type: unsigned32, Unpack: N
Flow: Name: flowEndSysUpTime, Id: 21, Length: 4, Type: unsigned32, Unpack: N
Flow: Name: sourceTransportPort, Id: 7, Length: 2, Type: unsigned16, Unpack: n
Flow: Name: destinationTransportPort, Id: 11, Length: 2, Type: unsigned16, Unpack: n
Flow: Name: ingressInterface, Id: 10, Length: 2, Type: unsigned32, Unpack: n
Flow: Name: egressInterface, Id: 14, Length: 2, Type: unsigned32, Unpack: n
Flow: Name: protocolIdentifier, Id: 4, Length: 1, Type: unsigned8, Unpack: C
Flow: Name: postIpDiffServCodePoint, Id: 98, Length: 1, Type: unsigned8, Unpack: C
Flow: Name: ipClassOfService, Id: 5, Length: 1, Type: unsigned8, Unpack: C
Flow: Name: postIpClassOfService, Id: 55, Length: 1, Type: unsigned8, Unpack: C
Flow: Name: applicationId, Id: 95, Length: 9, Type: octetArray, Unpack: C9
Flow: Name: vendorReserved, Id: 66, Length: 4, Type: string, Unpack: C4
Flow: Name: vendorReserved, Id: 65, Length: 2, Type: string, Unpack: C2
Flow: Name: forwardingStatus, Id: 89, Length: 1, Type: unsigned8, Unpack: C
Flow: Name: flowEndReason, Id: 136, Length: 1, Type: unsigned8, Unpack: C
Flow: Name: sourceIPv4Address, Id: 8, Length: 4, Type: ipv4Address, Unpack: C4
Flow: Name: destinationIPv4Address, Id: 12, Length: 4, Type: ipv4Address, Unpack: C4
Flow: Template Captured, Template:258 Size:69


Do you get something like this?

[duwijakarta]

You can try debug:
1) Disable all flow collectors
2) Go to console -> Flowview -> collectors -> edit your collector. You wil see in address id of collector (flowview_devices.php?action=edit&id=2)
3) run /path/to/php /path/to/cacti/plugins/flowview/flow_collector.php --debug --listener-id=YOUR_ID
4) you should see something like:

The buffer is 1236, The peer is 192.168.222.1
-----------------------------------------------
Flow: Sleep Time: 0.00
Flow: Packet from: 192.168.222.1 v9 - Len: 1236
Flow: Processing v9 Data, Records: 3
===============================================
Flow: Template Sets Found
Flow: Template Set Length: 1140
===============================================
Flow: Template Id: 258 with 21 fields
Flow: Name: octetDeltaCount, Id: 1, Length: 8, Type: unsigned64, Unpack: J
Flow: Name: postOctetDeltaCount, Id: 23, Length: 8, Type: unsigned64, Unpack: J
Flow: Name: packetDeltaCount, Id: 2, Length: 4, Type: unsigned64, Unpack: N
Flow: Name: postPacketDeltaCount, Id: 24, Length: 4, Type: unsigned64, Unpack: N
Flow: Name: flowStartSysUpTime, Id: 22, Length: 4, Type: unsigned32, Unpack: N
Flow: Name: flowEndSysUpTime, Id: 21, Length: 4, Type: unsigned32, Unpack: N
Flow: Name: sourceTransportPort, Id: 7, Length: 2, Type: unsigned16, Unpack: n
Flow: Name: destinationTransportPort, Id: 11, Length: 2, Type: unsigned16, Unpack: n
Flow: Name: ingressInterface, Id: 10, Length: 2, Type: unsigned32, Unpack: n
Flow: Name: egressInterface, Id: 14, Length: 2, Type: unsigned32, Unpack: n
Flow: Name: protocolIdentifier, Id: 4, Length: 1, Type: unsigned8, Unpack: C
Flow: Name: postIpDiffServCodePoint, Id: 98, Length: 1, Type: unsigned8, Unpack: C
Flow: Name: ipClassOfService, Id: 5, Length: 1, Type: unsigned8, Unpack: C
Flow: Name: postIpClassOfService, Id: 55, Length: 1, Type: unsigned8, Unpack: C
Flow: Name: applicationId, Id: 95, Length: 9, Type: octetArray, Unpack: C9
Flow: Name: vendorReserved, Id: 66, Length: 4, Type: string, Unpack: C4
Flow: Name: vendorReserved, Id: 65, Length: 2, Type: string, Unpack: C2
Flow: Name: forwardingStatus, Id: 89, Length: 1, Type: unsigned8, Unpack: C
Flow: Name: flowEndReason, Id: 136, Length: 1, Type: unsigned8, Unpack: C
Flow: Name: sourceIPv4Address, Id: 8, Length: 4, Type: ipv4Address, Unpack: C4
Flow: Name: destinationIPv4Address, Id: 12, Length: 4, Type: ipv4Address, Unpack: C4
Flow: Template Captured, Template:258 Size:69


Do you get something like this?

thanks sir,
what do you mean by disabling all flow collectors like this? I go to the console menu -> flowview, there are only listeners, filters, schedules, databases, where do I find collectors and see the id of the collector?

[macan]

Read plugins/flowview/service/README.md.

[duwijakarta]

Read plugins/flowview/service/README.md.

the result

PHP Warning: socket_bind(): Unable to bind address [98]: Address already in use in /var/www/html/cacti/plugins/flowview/flow_collector.php on line 732
The Send buffer is: 208 KBytes
The Receive buffer is: 208 KBytesm

[macan]

so your collector is running. You need to stop it
ps ax | grep flow

[duwijakarta]

so your collector is running. You need to stop it
ps ax | grep flow

It's like this, the result is still the same, when I kill the remaining 1, the result is, kill: (288251): No such process,
It turns out that after repeated checking, the flow collector reappears after being killed. How do you solve this? Or what is the correct way to disable it?

[duwijakarta]

You can try debug:
1) Disable all flow collectors
2) Go to console -> Flowview -> collectors -> edit your collector. You wil see in address id of collector (flowview_devices.php?action=edit&id=2)
3) run /path/to/php /path/to/cacti/plugins/flowview/flow_collector.php --debug --listener-id=YOUR_ID
4) you should see something like:

The buffer is 1236, The peer is 192.168.222.1
-----------------------------------------------
Flow: Sleep Time: 0.00
Flow: Packet from: 192.168.222.1 v9 - Len: 1236
Flow: Processing v9 Data, Records: 3
===============================================
Flow: Template Sets Found
Flow: Template Set Length: 1140
===============================================
Flow: Template Id: 258 with 21 fields
Flow: Name: octetDeltaCount, Id: 1, Length: 8, Type: unsigned64, Unpack: J
Flow: Name: postOctetDeltaCount, Id: 23, Length: 8, Type: unsigned64, Unpack: J
Flow: Name: packetDeltaCount, Id: 2, Length: 4, Type: unsigned64, Unpack: N
Flow: Name: postPacketDeltaCount, Id: 24, Length: 4, Type: unsigned64, Unpack: N
Flow: Name: flowStartSysUpTime, Id: 22, Length: 4, Type: unsigned32, Unpack: N
Flow: Name: flowEndSysUpTime, Id: 21, Length: 4, Type: unsigned32, Unpack: N
Flow: Name: sourceTransportPort, Id: 7, Length: 2, Type: unsigned16, Unpack: n
Flow: Name: destinationTransportPort, Id: 11, Length: 2, Type: unsigned16, Unpack: n
Flow: Name: ingressInterface, Id: 10, Length: 2, Type: unsigned32, Unpack: n
Flow: Name: egressInterface, Id: 14, Length: 2, Type: unsigned32, Unpack: n
Flow: Name: protocolIdentifier, Id: 4, Length: 1, Type: unsigned8, Unpack: C
Flow: Name: postIpDiffServCodePoint, Id: 98, Length: 1, Type: unsigned8, Unpack: C
Flow: Name: ipClassOfService, Id: 5, Length: 1, Type: unsigned8, Unpack: C
Flow: Name: postIpClassOfService, Id: 55, Length: 1, Type: unsigned8, Unpack: C
Flow: Name: applicationId, Id: 95, Length: 9, Type: octetArray, Unpack: C9
Flow: Name: vendorReserved, Id: 66, Length: 4, Type: string, Unpack: C4
Flow: Name: vendorReserved, Id: 65, Length: 2, Type: string, Unpack: C2
Flow: Name: forwardingStatus, Id: 89, Length: 1, Type: unsigned8, Unpack: C
Flow: Name: flowEndReason, Id: 136, Length: 1, Type: unsigned8, Unpack: C
Flow: Name: sourceIPv4Address, Id: 8, Length: 4, Type: ipv4Address, Unpack: C4
Flow: Name: destinationIPv4Address, Id: 12, Length: 4, Type: ipv4Address, Unpack: C4
Flow: Template Captured, Template:258 Size:69


Do you get something like this?

great, after I tried to find out, and it turned out that the cause was in the flow collector port and nfcapd clashed using 2055, after I customized the device to port 2056 and the listener also used 2056, the flow view feature ran immediately.

but there was the next obstacle, at the beginning of the flow view check only data related to udp / tcp appeared while the source ip or destination ip data did not appear, why is that?

but for the souce ip or destionation ip data it appeared, after I tried the timespan mode and the graph was immediately empty again, is it because the process was still new?

to create the next listener, it still uses 2056, is it okay? and can't the flow collector port and nfcapd use the same port?

[macan]

use the same port is not possible. It is not cacti issue, it is normal behavior.
You can use any other port

[duwijakarta]

use the same port is not possible. It is not cacti issue, it is normal behavior.
You can use any other port

yes that's right, what I mean is I just managed to find an issue in my flowview settings that previously caused the data to fail to come out,

next for this setting do I need to fill in specifics or just leave it as it is?
and
in the future if I want to make a listener to be more specific, is it better to fill in the allowed range settings according to the device IP or source IP interface based on the netflow that we set on the device?
for example the device IP is 172.x.x.2/24 later in the allowed range menu it will be filled in 172.x.x.2/32 or 172.x.x.2?