Page 1 of 1

Source created, NNA not listening on the unique port

Posted: Sat Nov 19, 2016 2:22 am
by concise
Hello,

I've installed NNA on CentOS 7 and everything looks good. I created a source and specified the port as 1100. When on NNA server, I try to telnet localhost 1100 it doesn't connect. However, the process seems to be running:

Code: Select all

# ps -ef --cols=300 |grep nfcapd
nna       8413     1  0 14:40 ?        00:00:00 /usr/local/bin/nfcapd -I 1 -l /usr/local/nagiosna/var/BrS/flows -p 1100 -x /usr/local/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/BrS/1100.pid -D -e -w -z
nna       8414  8413  0 14:40 ?        00:00:00 /usr/local/bin/nfcapd -I 1 -l /usr/local/nagiosna/var/BrS/flows -p 1100 -x /usr/local/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/BrS/1100.pid -D -e -w -z
root      8871  8666  0 15:07 pts/1    00:00:00 grep --color=auto nfcapd

Code: Select all

# telnet localhost 1100
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Connection refused
Please help me get NNA running and start collecting data from a linux source.

Thanks

Re: Source created, NNA not listening on the unique port

Posted: Mon Nov 21, 2016 1:32 pm
by tgriep
Netflow or Sflow sources uses UDP and not TCP to send it's data so that is why the telnet command it not functioning for you as it is TCP only.
If you want to see if the server is receiving data on that port, you can run the tcpdump command.
Run this as root replacing the <int> option with the interface name for the ethernet connection to your server.

Code: Select all

tcpdump -i  <inet> -s 65535  port 1100

Re: Source created, NNA not listening on the unique port

Posted: Tue Nov 22, 2016 1:14 am
by concise
Thank you. I had the firewall block UDP and that is the reason data collection did not work. My bad. How silly of me!!

Everything works as expected.

Re: Source created, NNA not listening on the unique port

Posted: Tue Nov 22, 2016 11:23 am
by avandemore
Glad you issue is resolved. I'm locking the ticket now. If you have further problems please open a new thread.