template not found

[jibanes]

Mikrotik 7.18:

[admin@xxx] /ip/traffic-flow> print
                enabled: yes
             interfaces: ether1
          cache-entries: 1M
    active-flow-timeout: 30m
  inactive-flow-timeout: 15s
        packet-sampling: no
      sampling-interval: 0
         sampling-space: 0

[admin@xxx] /ip/traffic-flow/target> print
Columns: SRC-ADDRESS, DST-ADDRESS, PORT, VERSION
# SRC-ADDRESS  DST-ADDRESS  PORT  VERSION
0 192.168.1.1  192.168.1.5  2059        9

Ubuntu 24.04.03/amd64:

$ ./dist/netflow2ng-0.1.0 -a "0.0.0.0:2059"
INFO    Using ntopng JSON format for ZMQ
INFO    Started ZMQ listener on: tcp://*:5556
INFO    Starting netflow2ng
INFO    starting collection
INFO    template error: receiver: message from [::ffff:192.168.1.1]:2059 NetFlowV9 [version:9 type:Decode obsDomainId:0: templateId:256] Error template not found
INFO    template error: receiver: message from [::ffff:192.168.1.1]:2059 NetFlowV9 [version:9 type:Decode obsDomainId:0: templateId:256] Error template not found

alternatively

$ ./dist/netflow2ng-0.1.0 -a "192.168.1.5:2059"
INFO    Using ntopng JSON format for ZMQ
INFO    Started ZMQ listener on: tcp://*:5556
INFO    Starting netflow2ng
INFO    starting collection
INFO    template error: receiver: message from 192.168.1.1:2059 NetFlowV9 [version:9 type:Decode obsDomainId:0: templateId:256] Error template not found

Please let me know if this is expected, thank you.

[muttley79]

Same here. Opnsense

[synfinatic]

Can you clarify that your issue is only regarding the error message and not anything to do with the functionality of netflow2ng?

[muttley79]

For me It seems that netflow2ng is working regardless of this error.
There are a lot of dropped zmq messages but it might me the fault of my opnsense box

[jibanes]

Can you clarify that your issue is only regarding the error message and not anything to do with the functionality of netflow2ng?

That's right, I just want to know if there is something wrong on my side, note that I do see the traffic in ntopng (with some packet drops, but it may be expected)

[kellybyrd]

The dropped ZMQ message in ntopng is definitely a bug unrelated to templates. I have a fix for it in PR #111, it's unrelated to that PR, was just something I found while testing so I fixed it. I can create a separate PR for just the dropped message issue.

But, that dropped messages has nothing to do with the template not found issue.

[kellybyrd]

To be clear, the missing templates is not an error. It is expected at startup. When netflow2ng initialized goflow2, it does not have any NFv9 templates from your netflow v9 source, so it cannot interpret the flows. Your source will send templates periodically and everything should be work after it does. But, I haven't tested how long that takes. I would expect it to be different for different sources, so Mikrotik might be different from OPNsense.

[jibanes]

Thank you @kellybyrd !

[kellybyrd]

I did some more digging. This message is from goflow2, not netflow2ng and is expected on startup. Each netflow v9 implementation can decide how often to send templates. For OPNsense, it looks like that is set to:
600 seconds or 500 netflow packets, whichever comes first. That may be the default on FreeBSD, dunno.

root@router:~ #
root@router:~ # ngctl msg netflow_ixl0: v9info
Rec'd response "v9info" (805306378) from "[2dd0]:":
Args:   { v9 template packets=500 v9 template time=600 v9 MTU=1500 }
root@router:~ #