-
Notifications
You must be signed in to change notification settings - Fork 31
Description
When softflowd exporters flow information, the input and output interface index numbers are always matching. This is causing the inbound and outbound flow statistics to show incorrectly in my IPFIX collector. There is another issue with interface index numbers being incorrect per what interface the flow data says the traffic was seen on.
WAN = interface index number 1
LAN = interface index number 2
When a packet comes inbound on my WAN interface, destined for an internal address, i would expect that packet to be routed OUTBOUND my LAN interface. The flow would show inputint = 1 and outputint = 2. That is not the case here.
Here is a flow that is from an external IP with a DstAddr = My External IP. The inputint = 2 (that should be 1) and outputint=2 (correct). I assume that the flow is captured on the WAN interface (index 1) in the inbound direction.
This flow shows traffic that is sourced from an internal IP to an External IP. I would expect to see it inbound on interface index 2 (LAN) and outbound on interface index 1 (WAN).
All configurations i have done are through the pfSense webui so im sure there may be some command line options i can update to get things working as i would expect them to. Any assistance here would be greatly appreciated.
I am using Scrutinizer as my IPFIX collector. I have verified the interface index number are what i would expect using SNMP. Traffic that should be seen on the WAN interface are being reported on the LAN. WHen i run a report on the Inbound direction of my WAN interface, i see Source addresses that are internal.