[nsp] No soruce address in netflow data from Catalyst6509

[Andrew Fort]

Joe Shen wrote:
> Hi,
>  
> When trying to process netflow data exported from a Catalyst6509 box
> (version 7),

> But, it shows , all Sif is "0000", and all SrcIPaddress is "0.0.0.0 ", and
> Pr is "00", P is "0".
> Why? Doesn't netflow v7 include these information?

v7 can, but the switch doesn't store it, by default, so the exports are 
all zeroes.  Check your flow-mask setting.  The default (IIRC), doesn't 
include source address/prefix/port/etc information.  If you want 'full' 
information, you'll need to use 'interface-full' flow-mask.  Setting 
higher resolution flow-masks, like interface-full, can have an impact on 
the switch that you should consider first in a lab environment.

-afort