# Flow Records Not Received

### SYMPTOM

Flow exporters are configured to output IPFIX, sFlow, or Netflow, but one or more flow exporters’ data does not appear in the ElastiFlow dashboards.

### PROBLEM

There can be several reasons for this:

* The packets carrying the expected flow records may not be arriving at the system running the collector.
* The packets carrying the expected flow records may be arriving on a UDP port on which the collector is not listening.
* The Linux firewall may be blocking the packets from reaching the collector.

### SOLUTION

Follow these steps to resolve the issue:

#### Verify Packets Are Arriving

Use `tcpdump` to verify that the packets carrying the expected flow records are arriving at the interface where the collector is listening. For example, if the collector is listening on UDP port `2055` (refer to [EF\_FLOW\_SERVER\_UDP\_PORT](https://github.com/elastiflow/documentation/blob/main/docs/config_ref/flowcoll/input_udp/README.md)) the following `tcpdump` command will show incoming packets to this port:

```shell
sudo tcpdump "udp port 2055"
```

If you are looking for packets from a specific exporter, you can also specify the exporter's IP address. For example, if packets are expected from `192.0.2.11` you would use the following command:

```shell
sudo tcpdump "src 192.0.2.11 and udp port 2055"
```

{% hint style="info" %}
You may need to specify the interface on which `tcpdump` should observe incoming packet. You can do this by specifying the `-i` option. For example?:

```shell
sudo tcpdump -i eth0 "src 192.0.2.11 and udp port 2055"
```

{% endhint %}

If you do not receive any packets, you will need to troubleshoot why they are not arriving. This could be because:

* the device is not sending them
* they are being sent to the wrong place
* they are being blocked along the way, e.g. by a firewall

You will need to troubleshoot and fix this issue before proceeding.

#### Verify that the Collector is Receiving the Packets

Verify that the collector is receiving the packets from the operating system, by running the collector with `debug` logging (`EF_LOGGER_LEVEL` set to `debug`). You should see messages indicating when packets are received and from which IP addresses they were sent.

If you have verified that the packets are arriving at the system, but you do not see any such messages in the collector's logs, the packets are likely being blocked by the Linux firewall. You can temporarily disable the Linux firewall to confirm this. If after doing this the logs indicate that packets are received, you will need to reconfigure the Linux firewall to allow the traffic to reach the collector.

### REFERENCE

* [`tcpdump`](https://www.tcpdump.org/manpages/tcpdump.1.html)
* [Netflow/IPFIX/sFlow UDP Input](https://github.com/elastiflow/documentation/blob/main/docs/config_ref/flowcoll/input_udp/README.md)
* [EF\_LOGGER\_LEVEL](https://github.com/elastiflow/documentation/blob/main/docs/config_ref/common/logging/README.md#ef_logger_level)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.elastiflow.com/additional-resources-reference-articles/faq/flow_records_not_received.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.