After upgrading NetOps Network Flow analysis Flow Cloner from 23.3.2 to Flow Cloner 23.3.5 trying to specifying a listener IP does not work on a system with 2 Network Interface cards.

Products

• Network Flow Analysis

Issue/Introduction

After upgrading from NetOps Network Flow analysis (NFA) / Flow Cloner version 23.3.2 to version 23.3.5, we are encountering difficulties specifying a listener IP on systems equipped with two Network Interface Cards (NICs).

Expected Behavior: Harvester IP 1.1.1.1 should be utilized for listening.

Unexpected Behavior: Despite specifying the listener IP as 1.1.1.1, the Harvester Backup IP (2.2.2.2) continues to be referenced in the retrans IP within the logs.

*********   CA NFA Flow Cloner   **********

10:25:52 Severity 1 - CA NFA Flow Cloner starting up, logging level: 5
10:25:52 Severity 3 - Accepting listen ip 1.1.1.1
10:25:52 Severity 3 - Using Default Port 9995 for Listen Port
10:25:52 Severity 3 - Using listen port 9995
10:25:52 Severity 3 - Using Default Port 9995 for Dest Port
10:25:52 Severity 3 - Using destination port 9995
10:25:52 Severity 3 - Using implicit retrans ip 2.2.2.2
10:25:52 Severity 3 - Accepting dest ip 6.6.6.6
10:25:52 Severity 3 - Using dest host ip: 6.6.6.6

10:25:52 Severity 3 - Client: Using local address 1.1.1.1, port 0
10:25:52 Severity 3 - Initialization is complete using port from sin_port 9995 from global 9995 
10:25:52 Severity 2 - b_test failure at E:\BuildAgent\work\Release\NFA_MAIN_PROD\NetFlow\NETFLOW\NFFlowCloneEngineApp\NFFlowCloneEngine.cpp 1023 - Send out datagram - 10051 A socket operation was attempted to an unreachable network.

10:25:52 Severity 2 - hr_test failure 0x87fb000b  at E:\BuildAgent\work\Release\NFA_MAIN_PROD\NetFlow\NETFLOW\NFFlowCloneEngineApp\NFFlowCloneEngine.cpp 1023 - 
10:25:52 Severity 2 - hr_test failure 0x87fb000b  at E:\BuildAgent\work\Release\NFA_MAIN_PROD\NetFlow\NETFLOW\NFFlowCloneEngineApp\NFFlowCloneEngine.cpp 754 - 
10:25:52 Severity 3 - In ServiceShutdownNotification - setting g_bShuttingDown to true
10:25:52 Severity 2 - Aborting service

Environment

DX NetOps Network Flow Analysis 23.3.5

Cause

Trying to use 2.2.2.2 results in socket operations Even when setting the listener IP to 1.1.1.1.

Resolution

To set the IP address of the Network Interface Card (NIC) through which the cloned packets are sent, utilize the "/retrans ip=" option. For instance:

/retrans ip=1.1.1.1

Updated basic configuration:

/port=9995 /retrans ip=x.x.x.x /listen ip=x.x.x.x; /dest ip=z.z.z.z ; Send flows to test system

Ensure to replace "x.x.x.x" with the appropriate IP address for the NIC, and "z.z.z.z" with the destination IP address for sending flows to the test system.