Re: [nsp] NetFlow

From: Craig A. Huegen (chuegen@quadrunner.com)
Date: Sat Mar 21 1998 - 15:09:58 EST


On Sat, 21 Mar 1998 jlixfeld@idirect.ca wrote:

11.1CA exports version 5 NetFlow data, while
11.2P and later exports version 1 NetFlow data.

Version 5 NetFlow will be in 12.0.

I recommend using 11.1CA unless you absolutely need 11.2P/11.3 features.

You need to enable flow exporting as well to your server:

li-rt-01(config)#ip flow-export ?
  destination Specify the Destination IP address
  source Specify the interface for source address
  version Specify the version number

And enable flow caching on an interface:

li-rt-01(config)#interface Serial1/0/0
li-rt-01(config-if)#ip route-cache flow

To verify if it is running, use the "show ip cache flow" command.

It will give you some info like this:

---
IP packet size distribution (1660M total packets):
   1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480
   .000 .397 .095 .069 .045 .013 .013 .009 .008 .009 .007 .007 .006 .005  .004

512 544 576 1024 1536 2048 2560 3072 3584 4096 4608 .004 .003 .041 .040 .214 .000 .000 .000 .000 .000 .000 [lots-o-more data here] ---

/cah

==>Hmm, thats the command that I have, but I can't seem to get it going. ==>When I to to the site, it tells me that their is no data. I have nfc and ==>the nfa display server going, but I can't figure it out. ==> ==>On Sat, 21 Mar 1998, Mark Prior wrote: ==> ==>: What IOS does this run on? Is it only 11.1(11)CA and 11.2(8)P?! Does it ==>: not run on 11.2(5)P?! I tried to enable it (on 11.2(5)P), as I was told ==>: the command is: ==>: ==>: enable ==>: conf t ==>: int fa0/0 ==>: ip route-cache flow netflow ==>: ==>: or something like that. Can anyone confirm, or deny?! Comments?! ==>: ==>:The interface command is "ip route-cache flow". I'm not sure which ==>:revision of 11.2P it appeared in first but it's in 11.2(12)P and we ==>:are using it in 11.1(17)CA. ==>: ==>:Mark. ==>: ==> ==>-- ==>Regards, ==> ==>Jason A. Lixfeld jlixfeld@idirect.ca ==>System Administrator [L5] jlixfeld@torontointernetxchange.net ==> ==>--------------------------------------------------------------------- ==>TUCOWS Interactive Ltd. o/a | "A Different Kind of Internet Company" ==>Internet Direct Canada Inc. | "FREE BANDWIDTH for Toronto Area IAPs" ==>5415 Dundas Street West | http://www.torontointernetxchange.net ==>Suite 301, Toronto Ontario | (416) 236-5806 ext 18 (T) ==>M9B-1B5 CANADA | (416) 236-5804 (F) ==>--------------------------------------------------------------------- ==>



This archive was generated by hypermail 2b29 : Sun Aug 04 2002 - 04:13:15 EDT