PFSense softflowd seen via tcpdump but zero samples/sec

[Kevin J Crandall]

I have SFTrend (free) running on Ubuntu 18.04 server with UFW and IPv6 disabled.

I am sending sflow from PFSense (192.168.1.1) softflowd to SFTrend (192.168.1.43) however:

# tcpdump host 192.168.1.1

08:49:01.980135 IP opsiquietsense.opsimath.org.39790 > opsibuntu.6343: sFlow version 589835 packet not supported

and 0 samples/sec

Anybody?

[Sonia Panchen]

The usual reasons for this are:

1. Firewall blocking port 6343 (tcpdump looks at packets before the firewall)

2. sFlow datagrams are malformed in some way. sFlow version 589835 reported by tcpdump is a bit suspicious. You could use wireshark to decode the traffic as sFlow and see if it complains.

[Peter Phaal]

I believe PFSense softflowd exports NetFlow records and not sFlow records. You could install the Host sFlow agent (sflow.net) to get sFlow.