As-stats com netflow mikrotik

[Edson Almeida]

Good evening everyone.
Could anyone give me an example and some tips on how to configure as-stats to receive Mikrotik netflow data? I have already made several attempts and I did not succeed. The files do not appear in the rrd file. In mikrotik is already enabled Traffic Flow and sending to the ip of the machine that is installed as-stats.
Thank you.

[Douglas Zaffari]

Good Morning! Anything new I have problems with mikrotik too.

[chri...@gmail.com]

Op maandag 17 april 2017 02:49:01 UTC+2 schreef Edson Almeida:

> Good evening everyone.
> Could anyone give me an example and some tips on how to configure as-stats to receive Mikrotik netflow data? I have already made several attempts and I did not succeed. The files do not appear in the rrd file. In mikrotik is already enabled Traffic Flow and sending to the ip of the machine that is installed as-stats.
> Thank you.

I had a similar problem as you but got it working (finally)
The problem was that I filled in the router's ip in knownlinks instead of the gateway ip. Check with tcpdump where the packages originate from (gateway or router ip)

Make sure mikrotik is using netflow V5 and NOT V9 and port 9996 (or whichever you prefer)

I'm using this line to start it:

perl asstatd.pl -r /opt/AS-Stats/rrd -p 9996 -P 6343 -k /opt/AS-Stats/conf/knownlinks -a 42337 -n -m /opt/AS-Stats/perl-ip2as/tools/ip2asn.json

It didn't generate rrd's without the ip2asn.json included. I used the openbsod fork.

I'm now facing an issue with sampling rate which seems to be off.. and mikrotik is unclear about the correct rate so it's guess work for each of our uplinks (depending on traffic volume)

[Edson Almeida]

Good Morning.

I performed all the tests and couldn't get it to work. I did the tests adding ip2asn.json, as I suggest, and it doesn't work. Nothing is created in the rrd directory.

A curious fact is that when I run an nmap, port 9000 appears as filtered.

Starting Nmap 7.12 ( https://nmap.org ) at 2020-06-13 10:23 BRT

Nmap scan report for localhost (127.0.0.1)

Host is up (0.000056s latency).

Not shown: 998 closed ports

PORT     STATE         SERVICE

53/udp   open          domain

9000/udp open|filtered cslistener

Nmap done: 1 IP address (1 host up) scanned in 1.28 seconds

Output of the netstat command:

udp   215104      0 0.0.0.0:9000            0.0.0.0:*

Any more suggestions?

Thanks.

Regards.

Edson

[Jaime Cabrera]

Edson, did you resolve your issue with mikrotik? I am in the same problem.

Regards