Trisul - Netflow ICMP issue - Unleash Networks Forum

Forum Login

Just ask your question

No signup required

There is no need to sign up or register to ask a question in the forums.

Just ask your question.

You need to signup if you wish to be notified of answers to your question by email.

Other links

Other ways to reach us

Follow us on Twitter

Send us an email

Welcome, Guest
Please Login or Register. Lost Password?

Unleash Networks Forum

Unleash Networks Forums

Unsniff Users

Trisul - Netflow ICMP issue

(1 viewing) (1) Guest

All your questions answered real quick by Unleash Networks Engineers.

Page: 1

TOPIC: Trisul - Netflow ICMP issue

Forum Tools

#267

Trisul - Netflow ICMP issue 2 Years ago Karma: 2

When Trisul is in NETFLOW_TAP mode, the server running Trisul may send ICMP Type 3, Destination Unreachable Port Unreachable packets back to the router.

The reason is :

1. Trisul does not depend on the UDP service to process Netflow packets, it picks it up from unix rx ring sockets or libpcap.

The best solution is to disable outgoing icmp 3

Code:

iptables -A OUTPUT -p icmp --icmp-type 3 -j DROP

An alternative solution : Just run a dummy server that opens a UDP port and sits there.

Code:



require 'socket'

UDPSocket.new.bind(nil,6343)

vivek [unleash]

Last Edit: 2010/02/02 10:07 By vivek [unleash].

Vivek R
Unleash Networks
Support : www.unleashnetworks.com/forums

Page: 1

Unleash Networks Forum

Unleash Networks Forums

Unsniff Users