[c-nsp] Netflow and Null0 configurations and performance on 7609
Kim Onnel
karim.adel at gmail.com
Mon Apr 11 05:30:32 EDT 2005
But now i dont even get numbers, i only get hyphens "- -"
80.29.66.1 196.204.231.75 tcp :18175 :1843 --
:0x0 260 156764 41 11:18:49 L3 - Dynamic
Any idea ?
Any known issues for the 7600 and NDE and Netflow ?
On Apr 11, 2005 11:14 AM, Ahmed Maged <ahmed_maged at rayatelecom.net> wrote:
>
>
>
>
>
>
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Kim
> Onnel
> Sent: Sunday, April 10, 2005 11:33 AM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Netflow and Null0 configurations and performance on 7609
>
>
>
> Hello,
>
>
>
> On my 7609 with IOS V. 12.2(18)SXD, I have the following
>
> configurations for netflow
>
>
>
> 7600#sh run | in flow
>
> mls flow ip interface-full
>
> no mls flow ipv6
>
> ip route-cache flow
>
> ip route-cache flow
>
> ip route-cache flow
>
> ip route-cache flow
>
> ip route-cache flow
>
> ip flow-export source Loopback0
>
> ip flow-export version 5 peer-as
>
> ip flow-export destination x.x.x.x 2055
>
>
>
> 7600#sh run | in mls
>
> mls aging fast time 5 threshold 32
>
> mls aging long 300
>
> mls aging normal 60
>
> mls flow ip interface-full
>
> no mls flow ipv6
>
> mls qos
>
> mls cef error action freeze
>
>
>
>
>
> Please correct me if i am wrong :
>
>
>
>
>
> sh ip cache flow: gives me the flows that matched an ACL an their port
>
> numbers and prot. in Hex like :
>
>
>
> Correct
>
>
>
>
> PO3/1/0 x.x.164.187 Null x.X.x.x 06 1108 0087
> 1
>
> PO4/0/0 x.x.189.191 Null x.x.x.x 06 0C09
> 0087 1
>
> Gi5/1 x.x.229.197 Null 192.168.34.97 06 27B2 01BD
> 1
>
>
>
> But because I enabled 'mls flow ip interface-full', I can see also
>
> the flows that didn't match an ACL like :
>
>
>
> Gi5/1 x.x.242.32 3.70.46.112 udp
>
> 20102 6346 1
>
> 1019 x.x.243.1 x.1x9.210.126 tcp
> 62351
>
> 4662 259
>
> 1019 x.x.127.191 1x.2x.252.208 tcp 4618
>
>
> 16881 5
>
> 1020 x.x.240.4 xx.1x.134.154 tcp www
>
> 1354 7
>
> Gi5/1 x.x.25.77 8x.x.115.231 tcp 1475
>
> 32656 7
>
> 1020 x.142.231.9 2x.2xx2.232.3 tcp
>
> 5100 1704 11
>
>
>
> As you can see on the left most column of the result of 'sh ip cache
>
> flow', the interface names are written in letters,
>
>
>
>
>
> but on the second results, the names are written in numbers (1020,
>
> 1019, 1016…) except for one of the Giga Ethernet interfaces(Gi5/1), it
>
> is still written in letters,
>
>
>
> My observation is that even if I disabled netflow (ip route-cache
>
> flow) from underneath all interfaces, except for one serial interface,
>
> I still get Gi5/1 in the results, and not the serial one that i want
>
> to look at, is there a known reason for that ?
>
>
>
> So, why am I getting numbers instead of names ?
>
>
>
> They are vlan numbers. The ifindexes are filled in based upon this value
> when the flow is exported to the collector. To see what vlan is assigned to
> an interface look at "sh vlan internal usage"
>
>
>
>
> My Netflow analysis tool doesnt report anything, even though i
>
> minimized its screaming thresholds, could this relate to its unability
>
> to read the interfaces numbers correctly,
>
>
>
> Also, What is the difference between the result of 'sh ip cache flow'
>
> and 'sh mls netflow ip' commands?
>
>
>
>
>
>
>
> On my hand is a case of an increase in the number of pps on one T3
>
> link from average 5-10 Kpps to 20 – 28 Kpps suddenly and it just kept
>
> on 27 Kpps, ranging from 26 to 28 Kpps
>
>
>
> I had to improvise so what I did was using the *nix command 'script
>
> /tmp/data' on a *nix box, logging to the switch, configured 'term
>
> length 0', and then scrolling 'sh ip cache flow' and then on the
>
> results file I did :
>
>
>
> awk '{print $2}' /tmp/data | sort | uniq –c | sort –rn | head
>
>
>
> And I get the IP addresses that reoccurred in the file, and i kept
>
> tracing them, putting ACLs,..
>
>
>
> What i would like to know, is there any CLI commands that can identify
>
> top talkers, anything beside 'sh ip cahe flow | in K', because it
>
> never gave me any results,
>
>
>
>
>
> Are the configurations of Netflow above optimum ? Any other available
>
> useful features that is should turn on ?
>
>
>
> Another issue is that I have an mrtg graph for Null0, so I can monitor
>
> scans, but there seems to be no hits on the interface, which is
>
> impossible, I can see from my flows some packets going to dark address
>
> space which we have a static for Null0 to.
>
>
>
> 7600#sh run int Null0
>
>
>
> interface Null0
>
> no ip unreachables
>
> end
>
>
>
> Is there any extra configurations needed, or is it an issue with my
>
> 7600 and IOS ?
>
>
>
> I would most definitely wish to see a document/post with most common
>
> netflow configurations, tricks and knobs known to man.
>
>
>
> _______________________________________________
>
> cisco-nsp mailing list cisco-nsp at puck.nether.net
>
> https://puck.nether.net/mailman/listinfo/cisco-nsp
>
> archive at http://puck.nether.net/pipermail/cisco-nsp/
More information about the cisco-nsp
mailing list