NetFlow Traffic Does Not Reach NetFlow Destination When Filter Expressions Are Based On Decoded Fields in Cribl Stream

Symptom

NetFlow data is visible during capture at the source and destination, but the downstream NetFlow destination does not receive the expected traffic when the output router is filtering on decoded flow fields, and tcpdump on the Cribl workers shows no matching outbound traffic for that routed flow.

Environment

• Product: Cribl Stream
• Source type: NetFlow
• Destination type: NetFlow
• NetFlow source configured with pass-through enabled

Resolution

1. Enable pass-through on the NetFlow source so Cribl Stream emits an additional event that contains __netflowRaw, which is the field required to forward raw NetFlow packets to a downstream NetFlow destination.
2. Update the output router condition so it matches pass-through events that contain __netflowRaw instead of matching only decoded flow fields such as ipv4SrcAddr.
3. If you need to route by source IP, evaluate the pass-through event and derive the address from __srcIpPort rather than using ipv4SrcAddr from the decoded record.
   • This is a sample of the an event that has the __netflowRaw field and these are some of the fields that you can use in your filter expressions.

     

4. Use a filter pattern similar to the following, replacing the placeholder IP values with the addresses relevant to the destination you are routing to:

   __netflowRaw != undefined && __srcIpPort && ['ip_1>', '<ip_2>', '<ip_3>'].includes(__srcIpPort.split('|')[1])

5. Validate the change with tcpdump on the Cribl workers or destination hosts to confirm the traffic is now leaving Cribl Stream for the NetFlow destination.
6. Confirm with the downstream receiving team or tool owner that the NetFlow data is being received in the expected format.

Cause

The output router condition was evaluating decoded NetFlow record events that exposed fields such as ipv4SrcAddr, but those decoded events did not contain __netflowRaw.

The pass-through event carried __netflowRaw and __srcIpPort, but not the decoded flow fields, so filtering on decoded fields prevented the raw NetFlow packet event from being selected and forwarded to the NetFlow destination.

Additional Information

The Cribl NetFlow source documentation notes that enabling pass-through creates an additional event containing __netflowRaw for routing to downstream NetFlow destinations.