Version 12.4

Introduction

We are excited to announce the release of Flowmon 12.4, which includes new features and enhancements for Network Performance Monitoring and Diagnostics (NPMD) and overall security improvements for the Flowmon product. This release:

• Speeds up IP queries in the Flowmon Monitoring Center.
• Provides the ability to toggle NPM metrics while investigating chart data in the Monitoring Center.
• Makes IP conversations the default option for the Advanced Analysis section in the Monitoring Center.
• Introduces a more user-friendly design for dashboard configuration options in the Dashboards and Reports sections.

Let us know your feedback

Customers helped to choose and validate some of the features that went into this release, and we want to hear from you to continue to improve Flowmon. You can request to join and participate in pre-release activities on the Flowmon Customer Validation Program (CVP), and vote for and submit your product ideas on our ideas portal. Thank you for helping to make Flowmon better!

Release history

• 12.4.3: Released 2024-09-11
• 12.4.2: Released 2024-08-27
• 12.4.1: Released 2024-07-29
• 12.4.0: Released 2024-07-24

What’s new in Flowmon 12.4

IP Indexing

Flowmon 12.4 has an option to build a search index of IP addresses and use it to accelerate your query performance.

Enabling IP indexing

IP indexing is enabled by default. From the moment 12.4 is installed, Flowmon starts calculating the IP Index for all new incoming data. Ask Flowmon Support about the possibility to calculate the IP Index for your historical data too.

To disable IP indexing:

1. Go to Configuration Center → FMC Configuration → Built-in Collector → Basic Settings.
2. Disable the Enable IP indexing toggle.

To use IP indexing:

1. Go to Monitoring Center → Analysis.
2. Select the All Sources profile (IP Indexing is only available for the All Sources profile).
3. In the Advanced Analysis section, select the Use IP Index check box.
4. Enter the entire IPv4 address into the text field.
   • Subnets and wildcards are not supported.
   • It is possible to enter multiple addresses, separated by a comma or whitespace. The query matches entries with at least one of the listed addresses.
5. You can use the Filter field to specify rest of your query. You do not need to to repeat the addresses from the Use IP-index field.
6. Click Process.

NPM metrics visibility in Analysis improvement

It is now possible to toggle visibility of NPM metrics individually on the Analysis page, allowing you to precisely configure what you want to see on the Analysis chart and focus on what is relevant.

How to toggle NPM Metrics visibility:

1. Go to Monitoring Center → Analysis.
2. Select Change displayed channels.
3. Using the check boxes to select which metrics to display individually.

IP conversation is the default option for TOP-N Statistics

IP conversations are now selected as the default option for TOP-N statistics, to streamline access to the most commonly used statistics option in Flowmon.

Where to find TOP-N Statistics:

1. Go to Monitoring Center → Analysis.
2. Scroll down to Advanced analysis.
3. IP conversation is selected by default.

Updated dashboard configuration dialog

The dashboard configuration dialog (where you can order, hide, and configure dashboards, in addition to selecting your preferred layout) has been updated to a new, more user-friendly design. The Default layout option was removed because it was almost identical to the Comfortable option, which is now the new default.

Where to find the dashboard configuration dialog:

1. Go to Dashboards and Reports.
2. Click the Dashboards configuration button.

Maintenance mode

The User interface (UI) switches to maintenance mode during the update of Flowmon 12.4.x to newer versions. The maintenance page displays the update status and the rest of the entire Flowmon UI is inaccessible for all users until the update completes.

How it works:

1. Go to Configuration Center → Versions.
2. Install a Flowmon update either through the available packages or by manually uploading.
3. The user who initiated the update will see the new maintenance page including the real-time state of the installation.
4. Other users will see the new maintenance page without the state of the installation.

LDAP - filtering groups for mapping

It is now possible to filter names of LDAP groups used for role mapping. This feature is useful when your LDAP server has more than a thousand groups.

How to use:

1. Go to Configuration Center → System → System settings → LDAP.
2. Enable LDAP support and save valid settings.
3. Enable mapping in the bottom of the form.
4. In the Filter groups for mapping field, enter words separated by comma.
5. Click Add mapping. The LDAP group select box only contains groups that contains one of the words from the input above.
6. Click Save after you add or edit the mapping.

Application info for IP addresses

The IP addresses in query results on the Analysis page (and in Dashboards and Reports) now have additional application information (presented in the form of an icon) providing you with immediate insights into the application or platform behind the external IP address. Additionally, blacklisted IP addresses (in Flowmon ADS blacklists) are also highlighted with an icon for easy identification.

This feature is available for users with ADS 12.4 installed.

Other changes - Flowmon 12.4.3

• The bind package was updated to version 9.11.4-26.P2.el7_9.17, fixing CVE-2024-1737 and CVE-2024-1975.

Other changes - Flowmon 12.4.2

• The Large Receive Offload (LRO) setting is disabled by default on monitoring ports. If it was previously enabled, increased packets per second statistics on the Collector may be noticed while the bytes per second statistics remain the same. Also, CPU load may be higher due to a larger amount of processed packets.
• The libndp package was updated to version 1.2-10.el7, fixing CVE-2024-5564.
• The Kerberos package was updated to version 1.15.1-55.el7_9.2, fixing CVE-2024-37370 and CVE-2024-37371.
• The java-1.8.0-openjdk package was updated to version java-1.8.0-openjdk-1.8.0.422b05-1.el7, fixing CVE-2024-21147.
• The OS kernel was updated to 3.10.0-1160.123.1.el7, fixing CVE-2022-1011 and CVE-2024-36971.
• PostgreSQL was updated to 15.8-1, fixing CVE-2024-7348.
• The urllib3 library was updated to version 1.26.19, fixing CVE-2024-37891.
• The requests library was updated to version 2.14.2, fixing CVE-2024-37891.
• The npm package was updated to version 10.8.2, fixing CVE-2024-28863.
• The httpd package was updated to version 2.4.6-99.el7.2, fixing CVE-2024-38474, CVE-2024-38475, and CVE-2024-38477.

Other changes - Flowmon 12.4.0, Flowmon 12.4.1

• PostgreSQL was updated to v15.7.
• PHP was updated to version 8.3.
• The OS kernel was updated to 3.10.0-1160.119.1, fixing CVE-2024-2193, CVE-2024-1086, CVE-2024-26602, CVE-2022-42896, CVE-2023-4921, CVE-2023-45871, and CVE-2023-38409.
• Volume type gp3 is now supported on AWS cloud.

Known issues

Due to the timezone being incorrectly handled during the update, users who installed Flowmon 12.4.0 outside of the UTC+2 timezone, may experience issues, for example, the Versions page does not load or there are various errors in Dashboards and Reports. For all appliances outside of UTC+2 timezone it is recommended to follow these steps to resolve the problem:

1. Go to Configuration Center > System > System Settings > Time zone.
2. Change the configured timezone (preferably to one with the same time, but a different location).
3. Save the changes.
4. You can then change the settings back to the original value.

After following these steps, the issue is resolved. The issue is fixed in Flowmon 12.4.1.

Fixed issues

Issues fixed in Flowmon 12.4.3

Ticket Number	Issue Topic	Issues Details	Resolution Details
209511,209590	Exporter	Exporter is failing on hardware Flowmon Probes with a disconnected link.	The Flowmon Probe is working properly on machines with a disconnected link.
208235	Distributed Architecture	Due to a configuration synchronization issue, if there was a high number of source interfaces in the system, the Slave Unit may not have started processing incoming flow data from newly added flow sources.	Flow sources configuration is now synchronized properly in Distributed Architecture.
205853	Forwarding Targets	Advanced flow forwarding sends non-zero padding in NetFlow9 packets.	Advanced flow forwarding contains only zero padding in NetFlow9 packets.

Issues fixed in Flowmon 12.4.2

Ticket Number	Issue Topic	Issues Details	Resolution Details
206431	Distributed Architecture	Replacement of the DA Proxy Unit can cause loss of data.	DA configuration distribution is initialized from the Master Unit only to prevent unexpected quota changes and flow source deletion, which lead to the data loss.
206442,206556	Collector	The Collector configuration may be broken due to an unexpected shutdown, causing flow collection issues.	The system prevents breaking of the configuration file after the unexpected reboot.
206983	Distributed Architecture	The process of re-adding a larger amount of detected flow sources is resource heavy, causing UI outages.	The system checks for already existing sources before trying to add them again.
206996	Configuration Center	The daemon log contains a large amount of error messages about missing PHP session files.	The daemon log is not spammed with error messages about missing PHP session files.
207063	Configuration Center	If the appliance has no monitoring ports, the wheel on the Monitoring ports tab in the FCC Overview page spins infinitely.	The FCC Overview page displays correctly if there are no monitoring ports in the system.
207169	Exporter	Monitoring ports restarts due to malformed DNS packets, caused gaps in monitored data.	Malformed DNS packets are not causing the monitoring ports to crash.
207327	Rest API	The REST API returns chart data in the GMT timezone.	The REST API returns chart data in the correct local timezone.

Issues fixed in Flowmon 12.4.1

Ticket Number	Issue Topic	Issues Details	Resolution Details
N/A	Update/Installation	The PostgreSQL timezone setting is reset to the default value after the update to Flowmon 12.4.0, causing various UI issues.	The timezone setting is properly migrated after the update.

Issues fixed in Flowmon 12.4.0

Ticket Number	Issue Topic	Issues Details	Resolution Details
205244	Distributed Architecture	On Distributed Architecture a race condition sometimes occurred which resulted in missing a 5-minute block of chart data from the Slave Unit.	The Slave Unit in Distributed Architecture (DA) properly sends graph data to the Master Unit, addressing occasional occurrences of "Missing data" error messages and data gaps.
N/A	Flow logs	Cloud flow logs did not respect Proxy settings.	Flow logs requests now go through a Proxy when configured.
N/A	Configuration backup	Old configuration backup files were not cleaned up properly resulting in increased disk usage	Configuration backup files are now removed after expiration.
205244	Distributed Architecture	-	If there is missing data from a DA Slave Unit, the notification message now contains information about the affected profile and channel.
205514	Exporter	Exporter is not working with a 10/25GB Mellanox network card if the card is inserted to NUMA node 1.	Fixed an issue when monitoring ports failed on PRO probe models with a 10/25GB Mellanox network card.
205867	REST API	-	The User Guide provides more information about REST API call visibility in the Active Sessions tab.
205963	Configuration Center	Automatic adjustment of Profile and module Quotas when running out of disk space was not working.	Automatic Quota adjustment now works.
205160	MIB	Syntactic errors present in FLOWMON-MIB.txt were causing issues when importing the file on some systems.	FLOWMON-MIB.txt errors fixed, so it can be uploaded to monitoring tools.
N/A	Analysis	Running TOP Statistic over IP Conversations required more memory than necessary.	Optimized memory consumption of IP Conversation queries.
202299	Dashboards and Reports	When a user was deleted, their dashboards were not correctly removed and remained in the database, which was causing issues in Distributed Architecture.	When a user is deleted, the dashboards data is now properly removed. During the update to 12.4, any existing dashboards without existing users are removed from the database.
202299	Distributed Architecture	It was not possible to check the Unable to change password and Disabled option for Admin users in DA.	Unable to change password and Disabled options can be changed for Admin users in DA.
202299	FMC Analysis	It was possible to save an empty filter, but it was not possible to import a configuration that contained an empty filter, which was causing issues with Distributed Architecture synchronization.	It is now possible to import a configuration with empty filters.
N/A	Distributed Architecture	When running Show in time on Distributed Architecture, the request took longer than necessary in cases where some Source groups had empty results.	Show in time requests on Distributed Architecture are now optimized to only query relevant source groups, and report empty results immediately.
200696	Collector	DNS and TLS flow fields from Gigamon devices were causing corrupted fields in collected flows.	DNS and TLS flow fields are now properly collected from Gigamon devices.
201076	Distributed Architecture	-	DA is not reporting hash mismatch error if the Probe license is not present.
201524	LDAP	LDAP group-role mapping was not working if there was more than 500 LDAP groups. LDAP users were not able to login.	LDAP groups mapping works properly for a high number of groups, so it is not causing login issues for users from affected groups.
200616	Distributed Architecture	Under some conditions, a delay in propagation of profile changes in DA caused a temporary configuration mismatch.	Profile changes on Distributed Architecture are now synchronized immediately in all conditions.
200841	Distributed Architecture	-	The NTP firewall rule for an inbound NTP connection on DA Master Unit is not causing hash mismatches in Active firewall rules.
202299	Distributed Architecture	Source detection on Distributed Architecture sometimes caused a temporary configuration mismatch.	The configuration mismatch is no longer occurring.
197818	Distributed Architecture	When editing a profile on Distributed Architecture, selecting the Save as new option failed in cases where parent profile was changed.	Save as new now works when the parent profile was changed.
182642	Update/Installation	Starting two update installations at the same time resulted in a broken appliance.	Fixed the installation process so it cannot be accidentally started twice in parallel.
203357	Distributed Architecture	If a module was disabled during an update on Distributed Architecture, it has its source group quota reset to default.	Module quota values in source groups are not reset after the update.
172595	Update/Installation	The Flowmon update process failed when the RPM check did not pass.	The update process does not fail if the RPM test did not pass and rebuilds the RPM files instead.

Release Information and Installation

Flowmon
Version: 12.4.3

Date: 2024-09-11

This package contains an update for Flowmon appliances.

Copyright Notice

Copyright © 2007 - 2024 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.

Support Information

If you need help, contact our Support team at the Flowmon Support and Learning Hub.

Compatibility

Version 12.4.3 and higher is compatible with the following modules:

• Flowmon ADS: v12.4.0
• Flowmon APM: v6.1.0
• Flowmon APM Probe: v6.1.0
• Flowmon APM TG: v2.10.0
• Flowmon DDoS Defender: v5.6.2
• Flowmon Packet Investigator: v12.3.0
• Flowmon Packet Investigator Probe: v12.3.0
• Data Retention: v5.3.0
• IDS Probe: v3.5.0

If an incompatible version of any module is installed on a Flowmon appliance, it will be stopped and disabled during the update to Flowmon version 12.4.x.
When a compatible version of the module is installed, the module will be automatically enabled and started again.

Installation requirements

• The Flowmon appliance must be updated to version 12.3.0 or newer before you can apply this update.
• Before you start updating the Flowmon appliance to version 12.4.x, ensure the installed modules meet the following version requirements:
  • Flowmon ADS: v12.3.0
  • Flowmon APM: v5.2.0
  • Flowmon APM Probe: v5.2.0
  • Flowmon APM TG: v2.9.0
  • Flowmon DDoS Defender: v5.6.0
  • Flowmon Packet Investigator: v12.2.0
  • Flowmon Packet Investigator Probe: v12.2.0
  • Data Retention: v5.1.0
  • IDS Probe: v3.3.1
• If any version is older than the ones specified above, the update will not complete successfully.

Installation

For the automatic package download from services.flowmon.com:

1. Log in to the Configuration Center on your Flowmon appliance.

2. Select the Versions tab.

3. Click Update the Package List.

4. If the Flowmon update package is available, Flowmon OS appears in the list.

5. Click Install for the Flowmon OS package.

Or, for the manual package download from the Flowmon Support Portal:

6. Download the package from the Support portal. Do NOT unpack it.

7. Log in to the Configuration Center on your Flowmon appliance.

8. Select the Versions tab.

9. Click Import Package and select the update file you downloaded in step 6.

The remaining installation steps are common for both paths:

10. During the installation, all users are logged out and Flowmon may become briefly unavailable and respond with Server Error - 500.

11. Wait until a notification is displayed informing you that the update was successful.