Capturing Cisco IPFIX flows

bassem zaki via Argus-info <[email protected]> Thu, 15 Dec 2016 14:08:08 +0200
Newsgroups gmane.network.argus
Message-ID <CA+kiuhvChdNsEcT27tZgCx765g2TJx3GFnGPDqoPYw5O8z31Rg@mail.gmail.com>
Hello all,

I'm new to Argus, and I'm trying to collect IPFIX flows sent from Cisco
router. Do I have to export the flows to an Argus server first then use ra
client tools to read those flows or can I just use client tools to read
flows sent directly from the cisco router?
I'm using (argus-clients-3.0.8.2) to collect the IPFIX but unfortunately
I'm caputering nothing at all. I thought maybe Argus doesn't support IPFIX
so I tried to collect netflow v5 exported by ipt_netflow but I had the same
result. I spent sometime reviewing the mailing list but I couldn't solve
the problem. I don't know exactly what I'm missing!!
Another question, reviewing GLORIAD solution made me really interested to
try argus, so I want to make sure that it's a good choice to monitor a
3Gbps network???

<SNIP>
# ra -A -S cisco://any:9996

^C Totalrecords 2         TotalManRecords 1         TotalFarRecords
0        TotalPkts 0        TotalBytes 0
<SNIP>

PS:
I made sure that I'm receiving the flows using tcpdump and tshark, and I
was already collecting flows using other netflow collecting tools like
nfacct, silk, and manageengine.

thanks,
bassem