[nsp] Where does OriginAS and PeerAS come from?

Pete Kruckenberg pete at kruckenberg.com
Wed Sep 3 16:36:01 EDT 2003

This is probably a really stupid question. But here goes.

When a Cisco router reports a flow via Netflow, how does it
determine the OriginAS (or PeerAS) it reports?

I assume Netflow does a route (EGP and IGP) lookup, to see
what prefix matches the source address and input interface
of the flow (is that a RIB lookup or a FIB lookup?). Is
there more to it than that?

Does my routing policy influence which PeerAS is recorded?  
Does Netflow always record the PeerAS associated with the
input interface, regardless of what (outbound) route may be

For example, if I receive a particular route on interface A
and B--from peers A and B, and I prefer the route from B,
what does NetFlow record for a PeerAS if a packet arrives on
interface A?

What if I filtered the incoming route from A altogether, so
the only route in my table was the one from B? Packet
arrives on interface A from peer A, does Netflow show the
PeerAS being A or B?

(Presumably this wouldn't be an issue for OriginAS, but
there are times when the same prefix originates from
different ASN's--does Netflow pick the right one regardless
of my routing policy?)


More information about the cisco-nsp mailing list