# Very huge amount of traffic by src IP. How handle it?

**URL:** https://discuss.elastic.co/t/very-huge-amount-of-traffic-by-src-ip-how-handle-it/134584
**Category:** Logstash
**Created:** [June 5, 2018, 9:54am UTC](https://discuss.elastic.co/t/very-huge-amount-of-traffic-by-src-ip-how-handle-it/134584 "2018-06-05T09:54:31Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Vladimir\_Fomin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vladimir_fomin/32/31413_2.png) [@Vladimir\_Fomin](https://discuss.elastic.co/u/Vladimir_Fomin)
#### Post date: [June 5, 2018, 9:54am UTC](https://discuss.elastic.co/t/very-huge-amount-of-traffic-by-src-ip-how-handle-it/134584/1 "2018-06-05T09:54:31Z")

</div>

I've start NetFlow by using this command `/usr/share/logstash/bin/logstash --modules netflow -M netflow.var.input.udp.port=9966` and it works.  
But when I look at overview traffic dashboard I see that some host send huge amount of traffic.

![image](https://us1.discourse-cdn.com/elastic/original/3X/6/8/687329325ea5154a316cfe78c3bb48ad073de76b.png)

And it's only one packet! We have tons of gigabytes per day for this host.

But in fact this host doesn't send this amount of traffic. Maybe field "netflow.bytes" for this host contains strange invalid value.  
Can I configure some filters to discard packets with this strange value?

---

<div class="post-metadata">

### Author: ![Magnus\_Kessler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnus_kessler/32/42001_2.png) [@Magnus\_Kessler](https://discuss.elastic.co/u/Magnus_Kessler)
#### Post date: [June 5, 2018, 10:46am UTC](https://discuss.elastic.co/t/very-huge-amount-of-traffic-by-src-ip-how-handle-it/134584/2 "2018-06-05T10:46:26Z")

</div>

Check if you have log entries like shown in [https://github.com/logstash-plugins/logstash-codec-netflow/issues/123](https://github.com/logstash-plugins/logstash-codec-netflow/issues/123).

If yes, try if updating to the latest version of the logstash-codec-netflow plugin resolves the issue.

```auto
bin/logstash-plugin update logstash-codec-netflow

```

I have seen incorrect field values (including netflow.bytes) if the data was interpreted incorrectly due to a misinterpreted netflow template.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 3, 2018, 10:46am UTC](https://discuss.elastic.co/t/very-huge-amount-of-traffic-by-src-ip-how-handle-it/134584/3 "2018-07-03T10:46:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.