[nsp] No soruce address in netflow data from Catalyst6509

Joe Shen jshen at christmas.9966.org
Mon Apr 26 04:07:27 EDT 2004


Hi,
 
When trying to process netflow data exported from a Catalyst6509 box
(version 7),
I print data file content by 
 
flow-print -f 24 < ./ft-v07.2004-04-09.165326+0800 > $HOME/test.txt
 
But, it shows , all Sif is "0000", and all SrcIPaddress is "0.0.0.0 ", and
Pr is "00", P is "0".
Why? Doesn't netflow v7 include these information?
 
 
Another question, could flow-merge maintein time stamp of each flow?
 
 
 
Regards
 
Joe Shen


More information about the cisco-nsp mailing list