When it comes to bringing usage data into Splynx, one of the methods that can be applied is NetFlow accounting. NetFlow accounting uses the NetFlow protocol that is universal for many manufacturers of network equipment. Using this protocol is convenient as the router (sensor) transfers packets with usage data information to the server for analysis at the right time. The following topology sample shows how the protocol collects and analyses usage data.

Splynx has used the NetFlow protocol for traffic accounting since version 3.1.

Below is the topology sample that depicts the captured flow of how Splynx and NetFlow accounting work.

Splynx server is both a NetFlow collector and NetFlow analyser at the same time. When receiving NetFlow packets, these data are instantly analysed, and the exact amount of traffic used by a subscriber is determined.

NetFlow packets are stored on the server. To prevent the unnecessary aggregation of already analysed packets, you can control the storage period and the amount of NetFlow packet data for each router in Splynx, setting them in Config → Networking → NetFlow Accounting → Expire options. Take a real-life look at the location of the Netflow packet data in the Splynx demo.

Configuration

1. You first need to specify the port on which the server will scan and collect NetFlow packets (udp/9995 by default) and the session timeout.

   

2. The next step is to configure the router in the system. In Internet services, specify which router is used.

   

   

3. After configuration, the server will start a process that will collect traffic data on the specified port, divide and analyze it for each router.

In addition, you can configure subnets for tariffs that include services where data usage accounting is ignored.

To set up the subnets, go to Config — Networking — Traffic class. In the tariff settings, specify which subnets will be excluded from the traffic accounting.

Troubleshooting

Case 1: Check the daemon state and log data

Splynx uses some scripts from the nfdump package to calculate traffic:

1. daemon nfcapd scans the port, and the data can be received there. When the interval for data collection ends, the data will be recorded in a file.
2. After that, the console script ./var/www/splynx/system/scripts/accounting-neflow starts runs the nfdump process with the specific parameters. The script gets a response and converts it into the acceptable format for the Splynx Accounting Processor.

To check if the nfcapd daemon runs, use this script:

ps -aux | grep nfcapd

To check the log:

sudo tail -f /var/log/syslog | grep nfcapd

Case 2: Missing MAC and Session ID values in the customer’s internet statistics

In the customer’s internet session statistics, you can notice that the last two sessions are listed without MAC and Session ID values. This is a common condition due to the limitations in NetFlow v5, which results in such data not being transferred to Splynx.