8.2. Frequently asked questions

8.2. Frequently asked questions
Prev	Chapter 8. Troubleshooting and frequently asked questions	Next

This page contains answers to some frequently asked questions when running sFlowTrend-Pro.

After I select a switch to monitor, why does nothing happen?
When I start sFlowTrend-Pro, why do I get an error message "Cannot open UDP port 6343"?
Why are most of the bars in a Top N traffic chart coloured grey?

After I select a switch to monitor, why does nothing happen?

sFlowTrend-Pro has an 'LED' at the bottom right of the window. This flashes green for every sFlow sample received. If it is not flashing, then no samples are being received. This can happen because no switch is configured to send sFlow, because there is insufficient network traffic on the switch to generate any sFlow, or because a firewall is blocking the sFlow data.

First, make sure that a switch is configured to send sFlow to sFlowTrend-Pro. With some switches, this can be done automatically, using sFlowTrend-Pro. Use the menu option Tools → Configure switches , and then Add. For other switches, sFlow must be configured through the switch's command line interface - refer to the manual for the switch. See also Section A.1.2, “Using the switch CLI to configure sFlow”.

If you think that sFlow is configured correctly, then try to ensure that sufficient network traffic is flowing through the switch. See Section 8.1.6, “sFlowTrend-Pro is not receiving sFlow from switch”

sFlow works by sending network packets to an sFlow collector, in this case sFlowTrend-Pro. The network packets are sent using UDP, on port 6343. If a firewall, either on the system running sFlowTrend-Pro or in the network, is blocking port 6343, then no sFlow data will reach sFlowTrend-Pro. Make sure that both the firewall on the system and all network firewall are allowing sFlow data through.

When I start sFlowTrend-Pro, why do I get an error message "Cannot open UDP port 6343"?

This error message almost always means that another application is already using the default sFlow port, which is UDP 6343. A port can be used by only one application. If you try to run sFlowTrend-Pro more than once on the same system or another sFlow collector is already running on the same system, then you will see this error. Examples of other sFlow collectors are InMon Traffic Sentinel, a switch vendor's element manager, or one of the other sFlow applications available.

To find out which application is already using the sFlow port, follow these instructions:

On Microsoft Windows, in a command prompt window, run the command:
```
netstat -p udp -a -b
                                
```
This command takes a while to run. When it has completed, in the output look for a line like the following, containing 6343:
```
   UDP    PCNAME:6343         *:*                     2428
  [javaw.exe]
                                
```
This is saying that the program javaw.exe is using port 6343. Any Java application will appear as javaw.exe on Microsoft Windows, or if the application is not written in Java, then the name of the application will be shown. The number at the right (2428 in this case) is the process ID of the application.
On Linux, from a terminal window, run the command:
```
netstat -l -p -u | grep sflow
                                
```
This should produce a (long) line like:
```
udp      0    0 *:sflow             *:*      26680/java
                                
```
The very last part of this line is telling us that the process with ID 26680 is running java, using port 6343. Again, if the application using the port is not written in Java, then the name of the program would be shown here.

Once you have identified which application is using the sFlow port, you can decide which application to run at any one time, or you can change the port that sFlowTrend-Pro uses, by entering a new port number in the dialog.

Note

If you change the port that sFlowTrend-Pro uses and your switches are configured using SNMP to send sFlow; (see Section A.1.1, “Using SNMP to configure the switch to send sFlow”), sFlowTrend-Pro will automatically reconfigure your switches to send sFlow to the new port. However, if your switches are configured via the CLI to send sFlow and you change the port used by sFlowTrend-Pro, you must also manually reconfigure your switches to send sFlow to the new port (see Section A.1.2, “Using the switch CLI to configure sFlow”).

Occasionally, a host firewall can also cause this error message. If you could not find another program using the sFlow port, then refer to the section above, on firewalls Section 8.2, “Frequently asked questions”.

Why are most of the bars in a Top N traffic chart coloured grey?

The grey part of a bar in a Top N traffic chart indicates that the traffic was from contributors not in the top N for the currently selected interval. See Section 3.2.2.1, “Understanding the Top N traffic chart”.