Probes in Packet Investagator disappear
If an invalid source, for example vulnerability scanner sends data to the Collector, FPI will lose connection with the Probes and the plugin needs to be restarted.
Version: FPI 12.0.1
Assigned Probes in Packet investigator disappear. Only restart FPI plugin will help.
|Steps to Reproduce:|
|Error Message:||In System messages:
Flow source X has sent unsupported flow data over TCP. Only IPFIX is supported
|Cause:||Device is sending invalid attempts to connect to the Collector and non-standard messages to FPI. Then FPI will lose the connection with the Probes.|
|Resolution:||In one of the future versions, FPI will be resistant to sended data from an invalid source.|
Check if the device is a valid flow data source and take necessary steps to stop sending data from this device to the Collector.