Skip to main content
Version: 2.10.0

Troubleshooting Guide

Introduction

This guide is designed to assist you in resolving common issues and challenges you might encounter while using NetFlow Optimizer.

NetFlow Optimizer software consists of the following components:

  • NFO Server (nfc_svr process)
  • NFO Controller (tomcat, jsvc processes)
  • External Data Feeder for NFO (EDFN) (jsvc process)

Step 1: Checking Internal Connectivity

If you successfully installed NetFlow Optimizer (NFO), but unable to login at https://<nfo-host>:8443 where nfo‑host is the IP address or host name of the NFO machine, you may encounter internal connectivity issues.

Check Tomcat Ports (8443 and 20047)

sudo netstat -npl | grep jsvc

You should see something like this:

tcp6       0      0 :::8443                 :::*                    LISTEN      39504/jsvc.exec     
tcp6 0 0 127.0.0.1:20047 :::* LISTEN 39504/jsvc.exec

Check Configuration Database Port (9001)

sudo netstat -nptl | grep :9001

You should see something like this:

tcp6       0      0 127.0.0.1:9001          :::*                    LISTEN      39557/../../java/jr

Check NFO Server Ports (when server is running)

sudo netstat -npl | grep nfc_svr

You should see something like this:

tcp        0      0 127.0.0.1:20048         0.0.0.0:*               LISTEN      40892/nfc_svr       
udp6 0 0 :::9995 :::* 40892/nfc_svr

Check Connections between NFO Server and Tomcat (controller)

sudo netstat -npat | grep -E ":2004(7|8)"

You should see something like this:

tcp        0      0 127.0.0.1:20048         0.0.0.0:*               LISTEN      40892/nfc_svr       
tcp 0 0 127.0.0.1:20048 127.0.0.1:46842 TIME_WAIT -
tcp 0 0 127.0.0.1:43270 127.0.0.1:20047 TIME_WAIT -
tcp6 0 0 127.0.0.1:20047 :::* LISTEN 39504/jsvc.exec

Step 2: Checking Firewall Rules

If you encounter any of the connectivity issues, you may check ufw or firewalld rules.

Ubuntu/Debian (ufw)

ufw status verbose

You should see something like this:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

To Action From
-- ------ ----
8443/tcp ALLOW IN Anywhere
9995/udp ALLOW IN Anywhere
162/udp ALLOW IN Anywhere
8443/tcp (v6) ALLOW IN Anywhere (v6)
9995/udp (v6) ALLOW IN Anywhere (v6)
162/udp (v6) ALLOW IN Anywhere (v6)

Red Hat, Rocky Linux, CentOS (firewalld)

firewall-cmd --list-all

You should see something like this:

public (active)
target: default
icmp-block-inversion: no
interfaces: eth0
sources:
services: dhcpv6-client ssh
ports: 8443/tcp 9995/udp 162/udp
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:

Step 3: Checking Rejected Connections

Ubuntu/Debian (ufw)

  1. Enable ufw logging:
sudo ufw logging low
  1. Check BLOCK messages using dmesg or journalctl:
journalctl -xe
dmesg | grep UFW | grep BLOCK

Red Hat, CentOS (firewalld)

  1. Get current firewalld log level:
sudo firewall-cmd --get-log-denied
  1. Change log level to all:
sudo firewall-cmd --set-log-denied=all
  1. Check REJECT messages using dmesg or journalctl:
journalctl -xe
dmesg | grep REJECT
  1. Revert firewalld log level if needed

Step 4: Checking NFO Connectivity with Exporters and Destinations

If you are able to login, but don't see incoming / outgoing traffic (you should see various counters increasing on the Status page), you may encounter connectivity issues beween NetFlow producers and NFO, or between NFO and destination systems.

Listening Ports (Inputs)

To check if NFO is listening on UDP port, and the port is not used by any other process, perform the following:

sudo netstat -lupn | grep ":9995"

You should see something like this:

3477468/nfc_svr

Incoming Traffic

To see incoming UDP traffic, you may use tcpdump utility. Here are a few examples:

sudo tcpdump -i any udp port 9995
sudo tcpdump -nni any port 2055 or port 9995 or port 4739 or port 6343 or port 9997

To see the HEX content of UDP packets:

sudo tcpdump -i any -XX udp port 9995

To capture incoming traffic in PCAP file use the following command:

sudo tcpdump -i any -p -s 0 -w netflow.pcap dst port 9995

With file rotation parameters:

sudo tcpdump -i any -p -s 0 -w netflow.pcap. -W 5 -C 10 -Z root dst port 9995

Outgoing Traffic

To see outgoing UDP messages, use the following command:

sudo tcpdump -nnAs0 dst 10.1.7.57 and udp port 1514

Step 5: NFO Logs

To help you identify NetFlow Optimizer (NFO) issues, you can share NFO logs with NetFlow Logic Support.

NFO logs its activity in $NFO_HOME/logs (NFO_HOME default is /opt/flowintegrator). You can also see their health on the Status page. This page shows input / output statistics, length of various queues, and drop counts.

The NFO internal log files are rolled based on size. Ten last files are kept in $NFO_HOME/logs/bak directory. You can change the default log rotation size and the number of “bak” files to keep by editing $NFO_HOME/server/etc/server.cfg.

Step 6: External Data Feeder for NFO Logs

EDFN performs the following functions:

  1. It feeds data to NFO for enrichments
  2. It receives cloud flow logs (AWS, Azure, Google)

EDFN logs its activity in $EDFN_HOME/logs (EDFN_HOME default is /opt/nfi-updater).

You can download logs from NFO by going to Tracing and Configuration on the left navigation bar, and clicking on Download logs button.

The zip file contains both NFO and EDFN logs.

You can securely share the logs with NetFlow Logic Support by opening a support ticket at https://www.netflowlogic.com/support.