[c-nsp] RSP 12.2(18)S NetFlow problems?

Jared Mauch jared at puck.nether.net
Wed Oct 20 16:40:40 EDT 2004


	Anyone else out there using a 7500 for NetFlow on 12.2(18)S4?

	I'm seeing some strangeness and i wanted to check with others
before i went into more details w/ cisco.

	i'm seeing tcpflags being set in the netflow v5 record where
it just doesn't make sense (eg: proto 17, aka UDP)

	i'm also seeing strange tcpflags combinations on proto=6 packets
that don't exactly make sense.. i was wondering if anyone else had seen
similar problems?

 v5 curpdu = 18
  v5 srcip = 1.2.3.4
  v5 dstip = 5.6.7.8
  v5 nexthop = 9.10.11.12
  v5 In/Out ifIndex = 6/6
  v5 Pkts/Octets = 1/93
  v5 Start/End sysUpTime = 1098304419/1098304419
  v5 src/dst ports = 5468/5759
  v5 proto = 17, tcp_flags = 0x10, tos = 0x0
  v5 dst_asn = xxx, src_asn = xxx, dst_mask = 21, src_mask = 18


-- 
Jared Mauch  | pgp key available via finger from jared at puck.nether.net
clue++;      | http://puck.nether.net/~jared/  My statements are only mine.


More information about the cisco-nsp mailing list