?
Solved

MikroTik RouterBoard, Bridged Ports, Netflow (traffic-flow)

Posted on 2010-01-12
16
Medium Priority
?
1,858 Views
Last Modified: 2012-05-08
I'm looking at putting a RB450G in place as a sort of 'tap' on a network (between the router and the switch).  My hope is to have the RB act as a silent bridge (possibly ponding two nics for in traffic and 2 for out traffic) while pushing netflow-v5 to a machine (running silk tools).

I currently have the device running with a bridge covering 4 of the nics.  Placing it between the router and the switch works, all hosts continue to have network access (so the bridge seems to work).  I have also implemented traffic-flow and have enabled it across all interfaces.

My questions:
- Traffic flow does not seem to be reporting all flows, any thoughts on this?
- When looking (in winbox) at the bridge interface, how come the statistics (packets in / out, etc etc) do not reflect the combination (summation) of all the ports  included in the bridge?
0
Comment
Question by:patrickLR
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 8
  • 5
  • 3
16 Comments
 
LVL 4

Expert Comment

by:JDLoaner
ID: 26296593
Is some of the traffic staying on the LAN and not going out the router?
0
 

Author Comment

by:patrickLR
ID: 26296714
All traffic is working fine, that is to say hosts have no idea the mikrotic is in place, I'm just trying to understand the traffic-flow output a bit better, as I don't believe it to be reflective of all traffic going through the bridge I have set up.

Just re-read your question, yes, some traffic traffic is probably not going through the routerboard, but that would be minimal (not many hosts internally), most would be going outside.  Is there any structural / logistical / implementation reasons why setting up traffic-flow on the RB would not lead to seeing all traffic going through it?
0
 
LVL 4

Expert Comment

by:JDLoaner
ID: 26296852
Well in all honesty any type of SPAN/Bridge port is not going to see "everything". If you want a better guarantee a hardware tap would be more suitable, however, expensive.
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:patrickLR
ID: 26296874
Can you maybe explain a bit about why it wouldn't see everything?  Also, if I were to reconfigure the RB to act as an actual router instead of a 'transparent bridge', I would assume I would actually see all traffic that would pass through the routerboard.
0
 
LVL 4

Expert Comment

by:JDLoaner
ID: 26296890
I also noticed you said something about two NIC's in and two out, that to mean seems like you might be missing some traffic right there. If you want better insight to your router's traffic flow, ONLY span and view the port the router is connected to.
0
 

Author Comment

by:patrickLR
ID: 26296929
ignore that part of my post, down the road I would look at maybe bonding two ports together just for throughput reasons.

At the moment I have a bridge set up on the RB that includes all ports (although only two are actually connected, eth1 for external / router, eth2 for internal / our switch).  Traffic-flow is enabled and monitoring those two ports.  Can you see any reason this would not see all traffic passing through the bridge?

0
 
LVL 37

Accepted Solution

by:
meverest earned 1000 total points
ID: 26300905
Hi,

since some of the traffic kind of reporting is done at a layer 3 level, you may need to set the bridge to 'use IP firewall' (click 'settings' on bridge tab of bridge configuration in winbox)

Cheers,  Mike.
0
 

Author Comment

by:patrickLR
ID: 26303338
will this hamper traffic at all?  I assume by enabling the firewall the default setting is 'no rules'?

Thanks,
-P
0
 
LVL 37

Expert Comment

by:meverest
ID: 26303582
>> will this hamper traffic at all?  

not likley - there may be some impact on performance, but if your CPU is not pegged already, then you probably won't notice any difference

>> I assume by enabling the firewall the default setting is 'no rules'?

correct assumption ;-)

Cheers!
0
 

Author Comment

by:patrickLR
ID: 26303627
Thanks, I've turned on ip firewall, although I can't find any good docs to explain how this relates to traffic-flow reporting, I do seem to be getting some better information now.  I've given you credit for the answer.

I do have a couple follow up questions, feel free to answer:
- Should I give ip addresses to the interfaces on the RB themselves?  (I have, just wondering what difference it makes)
- Do you know of any better sources of information about routerboards and different config examples of them besides their wiki?

Thanks,
-P
0
 
LVL 37

Expert Comment

by:meverest
ID: 26304445
G'day,

>> - Should I give ip addresses to the interfaces on the RB themselves?  (I have, just wondering what difference it makes)

I can't think of any benefit you will get from that - if you aren't routing through the system, then there's no real need for addresses bound to the interfaces at all!

>> - Do you know of any better sources of information about routerboards and different config examples of them besides their wiki?

apart from the mikrotik wiki and the mikrotik forums, there is not a great deal of info.  There are some places, that have a little bit of interesting detail (e.g. http://shop.duxtel.com.au/articles.php?tPath=5) but the official site/s are still the best resource available.

Cheers!
0
 

Author Comment

by:patrickLR
ID: 26304506
Thanks, I'll probably leave one port out of the bridge with a dhcp server on it (convenience) so I can manage the thing without needing to hook into the serial port , unless you have better suggestions.

Thanks for the link, I'll keep reading the wiki and forums, cheers.

-P
0
 
LVL 37

Expert Comment

by:meverest
ID: 26304546
>> I'll probably leave one port out of the bridge with a dhcp server on it (convenience) so I can manage the thing without needing to hook into the serial port

winbox can connect to a device by MAC address only - no need for an IP address there either!

Cheers.
0
 

Author Comment

by:patrickLR
ID: 26304593
that I did not know, thank you!

(I'm generally finding this device to be quite good, but the lack of 'not beginner, not expert' documentation a bit difficult.  All the wiki stuff tends to be overly simplistic or lacks explanation for the more complicated stuff)

Again, thanks,
-P
0
 
LVL 37

Expert Comment

by:meverest
ID: 26309949
Hi,

yes - if you are not already relatively highly experienced, many of those advanced functions seem little more than 'black magic'.

There is a book though: http://shop.duxtel.com.au/product_info.php?products_id=87

available from various sellers.

Cheers!
0
 

Author Comment

by:patrickLR
ID: 26455407
Hi, opening up this thread again, I've had great success with placing the RB between a networks router and switch for getting traffic flow data, now I'm trying to place it off of a spanning port (monitor port) instead of inline, anyone have any suggestions / thoughts on how well this work?  Do I need to change anything on the RB itself?

-P
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The Cisco RV042 router is a popular small network interfacing device that is often used as an internet gateway. Network administrators need to get at the management interface to make settings, change passwords, etc. This access is generally done usi…
Tired of waiting for your show or movie to load?  Are buffering issues a constant problem with your internet connection?  Check this article out to see if these simple adjustments are the solution for you.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
Suggested Courses

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question