The flow collector’s log indicates, Could not decode flowsets: template not yet received.
The Unified Flow Collector's log indicates a message similar to the following:
This may occur for both Netflow v9 and IPFIX.
Unlike earlier versions of Netflow, Netflow v9 and IPFIX do not contain a static set of information elements (IEs). The vendor can decide which they wish to send, as well as any vendor-defined IEs.
For the collector to be able to decode Netflow v9 and IPFIX records, it needs a description of the contents that the flow exporter will be sending. This is called a template. The collector will be unable to decode any flow record for which it has not yet received a template. As such, this error message indicates that is still waiting to receive a template from the device.
In most cases, waiting will allow the issue to resolve itself. These messages will likely be seen when starting the flow collector, but should stop appearing after the needed templates have been received. Devices will usually send templates every few minutes, although some may take 15-30 minutes. This interval is usually configurable, but it may vary by vendor and model.
If waiting does not solve the problem, subscription customers can contact . Community users can reach out to us via the . To investigate we will need a PCAP of the incoming records from the device in question. The PCAP will need to be long enough to include templates.
The following tcpdump example will capture incoming packets to port 2055 from 192.0.2.11 and write them to a file named netflow.pcap.