- The Flow Collector sends results to Highlight every 10 minutes
- Highlight summarises results every hour on the hour
- There is an option when viewing "today" to view the 6 most recent 10 minute summaries
- The number below the Flow chart is the start time, so "8" represents 8am - 9am
Firstly, check that the target Flow Collector is enabled for use from the folder/location. Contact us to confirm that the Flow Collector is responding correctly and assigned to the folder required.
Next, check that UDP port 9996 is allowed from the source device to the Flow Collector. Refer to your firewall team to confirm.
Finally, confirm that there is a route from the source device to the collector by pinging the collector IP address.
If still a problem contact us for further assistance.
To confirm which devices are not reporting Flow, run an Admin watch report and check which Flow entries have no recent data.
It may be that Highlight has not been configured to match the settings on the router. For ease of comparison, look at the results of the following router commands:
show ip flow export
show ip flow interface
or for Flexible Netflow use a combination of the following:
show flow monitor
show flow exporter
show flow exporter statistics
show flow interface
- Today is viewed in Highlight rather than week or month view after setting the watch to monitor Flow
- The export destination in the device configuration is that of the flow collector, and the port is 9996
- The IP source of the flow packets is defined in Highlight, in the Edit watch Application tab. Note: Flow source must be an interface with an associated IP address. A physical interface with no IP address will not work.
- The interface configured with ip flow ingress is listed and techtested in the Edit watch Application tab
ip route-cacheis configured on the router
- there is no other Highlight entry using the same combination of Flow source IP address and Flow-monitored interface in the Edit watch Applications tab. For users with permission "View 'Admin' reports" this can be checked by downloading a Watch report on the Reporting Network page.
- For Juniper J-Flow ensure that the .0 sub-interface is selected rather than the physical interface which has the configuration. For example if interface fe-0/0/0 has the sampling configuration, select fe-0/0/0.0 from the list on the Applications tab.
The likely cause of this depends on whether Flow version 5 is defined or Flow version 9.
Flow version 5
ip flow ingressis defined on all active interfaces
Flow version 9
ip flow ingressand
ip flow egressare defined on the monitored interface for Flow.
Alternatively if the device being monitored has only one interface connected (e.g. a newly installed device), traffic sourced from the router is not included in the exported Flow records so there is no outbound traffic reported.
This symptom has been seen when Flow version 5 is defined.
ip flow egressis removed on all interfaces in order to avoid double counting
- Alternatively change device configuration to use Flow version 9
Flow analysis and Highlight Link Health monitoring can have different interfaces specified. If that is the case there is no direct comparison of volumes.
- (Flow version 5) Ensure
ip flow ingressis defined on all interfaces carrying traffic
- (J-Flow) Check the sampling rate. For example if using 1 in 20 packets then the volumes reported would be about 5% of that possible.
- Try the Flexible Netflow configuration page
If flow analysis stops for a single device but for no obvious reason, this can be caused by a router change, either replacement or configuration, which has altered the number of the interface being monitored. The solution for this is:
- Reselect the Interface to be monitored for Flow in the Applications tab of the device
- Also if an additional interface has been added to the router and to avoid a recurrence of this symptom then add the following device configuration for interface persistence:
snmp-server ifindex persist
- This is standard behaviour.
Day view shows the top 20 applications or hosts in that day.
Week view by day displays the applications/hosts from the week's top 20 which were seen on the day in question.
Daily Flow summary for Monday
Weekly Flow summary, broken down for the Monday
If there is no success following the points above, it is likely to require access to the Flow Collector to check the logs and/or run a packet capture. Contact us for further assistance.