Flow data is missing due to Switch IP Configuration in VCF Operations for Networks
search cancel

Flow data is missing due to Switch IP Configuration in VCF Operations for Networks

book

Article ID: 442590

calendar_today

Updated On:

Products

VCF Operations for Networks

Issue/Introduction

  • VCF Operations for Networks shows active collection for a vCenter data source, but no flow data is visible in the GUI for one or more sites.
  • IPFIX is confirmed to be enabled on the vSphere Distributed Switch (VDS) and individual Distributed Port Groups.
  • The flow-processor logs on the Collector appliance contain a high volume of DATA_SOURCE_DISABLED warnings similar to the following example:
2026-06-01T12:51:33.000506Z WARNING flow-processor 15750 [netw@4413 class="v2.helpers.IpfixRawFlowValidator" thread="five_tuple_task-2" method="rejectEarly" line="245"] DataSource is disabled: RawIpfixFlow{uberType=VDS, srcIp=#######, dstIp#######, srcPort=53, dstPort=62635, protocol=UDP, allowed=true, sessionFlags=-1, reporterIp=IPAddress{ipv4=#######, ipv6Subnet=0, ipv6Interface=0, isIPv4=true}, vifUUID=null, vmUUID=null}
  • The flow-processor logs on the Collector appliance contains rejection statistics with a large number in DATA_SOURCE_DISABLED similar to the following example:
2026-06-01T12:51:33.000810Z INFO flow-processor 15750 [netw@4413 class="v2.helpers.IpfixRawFlowValidator" thread="five_tuple_task-2" method="printAndResetRejectionStats" line="472"] Raw Ipfix Record Rejection Stats [file=/var/flows/vds/nfcapd/nfcapd.202606011250]: DENY_FLOWS:0 WRONG_REPORTING_POINT:0 DATA_SOURCE_DISABLED:4765370 SESSION_NOT_ESTABLISHED:0 NO_METRIC_DATA_4:0 NO_METRIC_DATA_6:0 ADDSTATE_WRONG_FLOW_TYPE:0 IPV6_LINK_LOCAL:0 NON_DOMAIN_NSXT_FLOWS:0 UNSUPPORTED_IPV6_FLOW_TYPE:0 IPFIX_ENABLED_ON_ANOTHER_COLLECTOR:0 DENY_NSX_INTERNET_FLOWS:0 DENY_NSX_FLOWS_RULE_ID_BASED:0 DENY_NSX_FLOWS_PORT_THRESHOLD_BASED:0 SMALL_BRICK_VC_WRONG_REPORTING:0 DROP_SPECIFIC_IPV4_UDP_TRAFFIC:0
  • The reporterIp in the flow-processor logs does not match the management IP address of any individual ESXi host in the environment.

    Note: the reporterIp is written as an integer and will need to be translated to an IP address for easier identification.

Environment

VCF Operations for Networks 9.x

Cause

This issue occurs when the Switch IP address field in the vSphere Distributed Switch (VDS) NetFlow settings is manually populated with a specific IP address.

VCF Operations for Networks requires IPFIX telemetry to be sourced directly from individual ESXi host management IP addresses. When a shared "Switch IP address" is configured on the VDS, all IPFIX packets arrive at the collector originating from that single shared IP. Because this IP does not map to a specific managed ESXi host within the integrated vCenter inventory, the appliance rejects the traffic to prevent corrupted topology state.

Resolution

To enable flow ingestion, the Switch IP address must be removed from the VDS configuration to allow the switch to revert to its default behavior of reporting flows via individual host IPs.

  1. Log into vCenter.
  2. Navigate to the Networking inventory view.
  3. Select the affected vSphere Distributed Switch (VDS).
  4. Navigate to Action > Settings > Edit NetFlow.
  5. Locate the Switch IP address field.
  6. Clear the field so it is completely empty.
  7. Click OK to save the configuration.
  8. Wait 15–30 minutes for flow ingestion to resume and populate in the VCF Operations for Networks UI.

Verification

  1. Verify in the VCF Operations for Networks UI that flow data is now appearing for the affected site using a query such as: flows where Source IP Address = <Test_VM_IP>
  2. (Optional) Check the latest.log in /var/log/arkin/flow-processor/ on the collector to confirm that the DATA_SOURCE_DISABLED warnings associated with the previous Switch IP have ceased.
Powered by Wolken Software