Repository navigation
Number of records in NetFlow v9 Message header doesn't match number of records found in the Message #87
Description
Here is such an error occurs when running ipfixcol2 -c ipfix.cfg how to fix it?
WARNING: UDP input (parser): [12.1.24.1:58633, ODID: 256] Number of records in NetFlow v9 Message header doesn't match number of records found in the Message (expected: 1, found: 0)
WARNING: UDP input (parser): [12.1.24.1:58633, ODID: 256] Unable to convert NetFlow v9 Data Set (FlowSet ID: 256) to IPFIX due to missing NetFlow template. The Data FlowSet and its records will be dropped!
Activity
Lukas955 commentedon Oct 18, 2023
Hi,
This occurs when the collector is started later than the flow data exporter (i.e. flow probe/router). When using UDP transmission, the so-called NetFlow/IPFIX templates that describe the structure of the flow records are sent at the beginning of the communication and at regular intervals (usually configurable on the flow exporter). Since the collector was started later, it did not have the opportunity to see the initial templates and is therefore temporarily unable to interpret the data, and therefore generates warnings. However, this problem resolves itself when the flow exporter resends the templates.
In other words, just wait a little while and the problem should resolve itself. Unfortunately, this is a "feature" of both NetFlow and IPFIX protocols when transmitted over UDP.
Lukas