Not seeing packets on ASA sources

This support forum board is for support questions relating to Nagios Network Analyzer, our network traffic and bandwidth analysis solution.
pythiangrp
Posts: 11
Joined: Mon Mar 23, 2015 12:16 pm

Not seeing packets on ASA sources

Post by pythiangrp »

I am working on updating and getting better configurations from Nagios NNA and the integration with Nagios XI.
Thus far, I have added many of my Cisco ASA hosts, as well as a couple of linux servers and routers.
All hosts are properly reporting bandwitdh graphs for the Bytes, Flows and Bytes/sec, but the ASA devices are not reporting back packets. If I filter the graph on Packets, it is blank. As well, I am not seeing any information in the Top Talkers area of the graph.
I have attached two graphs showing this on a 5540, but I am seeing the same results with a 5520, some 5510 and a 5505.

Any assistance is greatly appreciated.
Andre
5540-Bandwidth.PNG
5540-NoPackets.PNG
You do not have the required permissions to view the files attached to this post.
jolson
Attack Rabbit
Posts: 2560
Joined: Thu Feb 12, 2015 12:40 pm

Re: Not seeing packets on ASA sources

Post by jolson »

You will need to recompile nfcapd with NSEL support. Follow this procedure:

Code: Select all

cd /tmp
wget http://sourceforge.net/projects/nfdump/files/stable/nfdump-1.6.13/nfdump-1.6.13.tar.gz/download
tar xzf download
cd nfdump-1.6.13/
./configure --enable-sflow --enable-nsel
make
make install
EDIT: After the procedure, you'll want to restart your sources: service nagiosna restart
Twits Blog
Show me a man who lives alone and has a perpetually clean kitchen, and 8 times out of 9 I'll show you a man with detestable spiritual qualities.
pythiangrp
Posts: 11
Joined: Mon Mar 23, 2015 12:16 pm

Re: Not seeing packets on ASA sources

Post by pythiangrp »

I recompiled nfcapd as suggested, and am now very happy to say that I can see the top talkers, run queries, etc... without issue.

That being said, when looking at the bandwidth graphs, it is still not reporting the number of packets, which I would like to have, if possible.
At first, I figured it was a timing issue, so after making the changes yesterday afternoon, I let it sit, but even now, about 20+ hours later, still not seeing the packets in the graphs.

Thanks,
Andre
NoPackets.PNG
You do not have the required permissions to view the files attached to this post.
ssax
Dreams In Code
Posts: 7682
Joined: Wed Feb 11, 2015 12:54 pm

Re: Not seeing packets on ASA sources

Post by ssax »

The ASA software doesn't send the number of packets in the data (I've verified this with a packet capture), I'm unsure if Cisco provides an updated firmware that would fix it, your best bet would be to call them and ask them and let us know their answer if you have support with them.
pythiangrp
Posts: 11
Joined: Mon Mar 23, 2015 12:16 pm

Re: Not seeing packets on ASA sources

Post by pythiangrp »

Thanks for the information about the packets.
Given that Cisco is not supplying them, all is good on my end, and if this needs to be marked as closed, it can.

Thanks!
Andre
tmcdonald
Posts: 9117
Joined: Mon Sep 23, 2013 8:40 am

Re: Not seeing packets on ASA sources

Post by tmcdonald »

That's our standard procedure, lock a thread when it's done. I'll do that, but if you hear anything from Cisco feel free to PM me and I will open it back up for your findings.
Former Nagios employee