NTop NetFlow

[GV27]

Hi all,

Does anyone have experience feeding NTop via NetFlow from their PA firewalls? I have it setup and sending flows but NTop sees all of the received flows as either "Flows with zero byte count" or "Flows with zero packet count" and discards them. Perhaps someone knows a fix for this?

Thanks,

Chris

[denisd2]

HI Chris,

     I have the exactly the same behavior using the ntop x86_64-apple-darwin11.4.0. Could you solve that ?

Thanks,

Denis D'Amico

[sbrenner]

I think the problem is that NTOP doesn't understand the PANOS field types. I have opened a bug with Luca (the NTOP dev.), and provided some NF pcaps, but I don't think he has had time to work on it.

-Scott

[UhMayYeah]

I have seen similar  issues with Orion Netflow Analyzer which was  due to the mismatching fields.

Please find a related  Bug .

Bug      Severity                Issue                                                                         Impact                                                     Root Cause                               Target Release

36257

Critical

4.1.1

Some data being sent to Netflow connector is in the wrong format.

Incomplete data received in collector.

Issue resolved with the direction of the packet flow.

4.1.7, 5.0.0

Refer:

https://live.paloaltonetworks.com/docs/DOC-1982

Regads,

Ameya

[LucWillems]

Hi all,

i also have this issue , using Ubuntu 12.04 ntop version (4.1) and PA-500 device using Pan OS 5.0.0.

upgraded to latest ntop didn't resolve the issue.

After doing some checking of the netflow packets send by PA-500 device , and source code of the netflow plugin

i noticed that ntop netflow plugin expects that packet size = 4 bytes , but PA-500 sends a size of 8 bytes.

if patched the ntop netflow plugin plugins/netflowPlugin.c , line 1721 like this

case 1: /* IN_BYTES */

if(fields[fieldId].fieldLen == 😎 {

   /* PA devices uses 8 for size, ignore first 4 bytes) */

  memcpy(&record.rcvdOctets, &buffer[displ+4], 4)

} else {

   memcpy(&record.rcvdOctets, &buffer[displ], 4);

}

you can view original code at https://svn.ntop.org/svn/ntop/trunk/ntop/plugins/netflowPlugin.c

rebuild debian package, and now it reporting correctly all flows.

  Luc

[sbrenner]

Just an FYI, Luca, the ntop developer put your changes in the latest SVN.

if(fields[fieldId].fieldLen == 😎 {

                      /*

                         PaloAlto devices uses 8 for size, ignore first 4 bytes)

                         Courtesy of Luc Willems <luc.willems@it4y.eu>

                       */

                      memcpy(&record.rcvdOctets, &buffer[displ+4], 4);

                    } else

                      memcpy(&record.rcvdOctets, &buffer[displ], 4);

-Scott