[nsp] No soruce address in netflow data from Catalyst6509
Joe Shen
jshen at christmas.9966.org
Mon Apr 26 04:07:27 EDT 2004
Hi,
When trying to process netflow data exported from a Catalyst6509 box
(version 7),
I print data file content by
flow-print -f 24 < ./ft-v07.2004-04-09.165326+0800 > $HOME/test.txt
But, it shows , all Sif is "0000", and all SrcIPaddress is "0.0.0.0 ", and
Pr is "00", P is "0".
Why? Doesn't netflow v7 include these information?
Another question, could flow-merge maintein time stamp of each flow?
Regards
Joe Shen
More information about the cisco-nsp
mailing list