[c-nsp] non-sampled netflow on 6500

[Matt Stockdale]

I'm doing a full netflow export (on our edge routers, sup720) for about
300Mbps of data, with aggressive flow aging, and it's about 2.5Mbps of
data. If you can live with that overhead, you can just select the data
you want based on IfIndex, and toss the rest with flow-tools.

I'm pretty new to the netflow stuff, hopefully someone with more of a
clue will chime in.

Matt

On Thu, 2006-03-16 at 11:55 +0100, nick.nauwelaerts at thomson.com wrote:
> Hello,
> I'm trying to get netflow going on a 6500 with sup720s (PFC3a) running
> ios 12.2(18)SXF1.
> 
> I went through the document on
> http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/122sx/swcg/n
> de.htm#wp1047637 and got it working, for a bit.
> 
> What I need is to know how much data and what kind goes over a vlan
> interface, which pushes only 1000pck/s. What I don't want is the data of
> all the rest that goes through the switch. So i configured "ip
> route-cache flow" on the vlan interface, which already gives me MSFC
> flow information. PFC flow information is more troublesome however.
> 
> My first thought was to place a filter on NDE, I got the subnets for
> which I needed the information and then found out NDE only allows for 1
> filter for source and destination, so that was a no go.
> 
> And now I'm kinda stuck. I don't want to swamp the collector nor switch
> with exporting the complete mls table, and sampled netflow (which can be
> done on an per-interface level) isn't accurate enough.
> 
> Any ideas on how to get non-sampled netflow for just 1 vlan interface on
> a 6500?
> 
> Thanks.
> 
> // nick
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>