Skip to content

Input and Ouput interface index numbers incorrect #63

@r-diggz

Description

@r-diggz

When softflowd exporters flow information, the input and output interface index numbers are always matching. This is causing the inbound and outbound flow statistics to show incorrectly in my IPFIX collector. There is another issue with interface index numbers being incorrect per what interface the flow data says the traffic was seen on.

WAN = interface index number 1
LAN = interface index number 2

When a packet comes inbound on my WAN interface, destined for an internal address, i would expect that packet to be routed OUTBOUND my LAN interface. The flow would show inputint = 1 and outputint = 2. That is not the case here.

Here is a flow that is from an external IP with a DstAddr = My External IP. The inputint = 2 (that should be 1) and outputint=2 (correct). I assume that the flow is captured on the WAN interface (index 1) in the inbound direction.

Image

This flow shows traffic that is sourced from an internal IP to an External IP. I would expect to see it inbound on interface index 2 (LAN) and outbound on interface index 1 (WAN).

Image

All configurations i have done are through the pfSense webui so im sure there may be some command line options i can update to get things working as i would expect them to. Any assistance here would be greatly appreciated.

I am using Scrutinizer as my IPFIX collector. I have verified the interface index number are what i would expect using SNMP. Traffic that should be seen on the WAN interface are being reported on the LAN. WHen i run a report on the Inbound direction of my WAN interface, i see Source addresses that are internal.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions