[c-nsp] Netflow vs NDE
Hank Nussbacher
hank at efes.iucc.ac.il
Thu Mar 23 03:51:01 EST 2006
I am wondering if I am double counting flows. Here is my config snippet
from a 7613 running 12.2(18)SXE4:
mls flow ip interface-full
mls nde sender version 5
!
ip flow-export source Loopback0
ip flow-export version 5 origin-as
ip flow-export destination XXX.139.197.76 9800
Most interfaces look like this:
interface Serial1/0/5
ip route-cache flow
But looking at:
gp1#sho ip flow export
Flow export v5 is enabled for main cache
Exporting flows to xxx.139.197.76 (9800)
Exporting using source interface Loopback0
Version 5 flow records, origin-as
460190792 flows exported in 15339766 udp datagrams
0 flows failed due to lack of export packet
3 export packets were sent up to process level
0 export packets were dropped due to no fib
199 export packets were dropped due to adjacency issues
0 export packets were dropped due to fragmentation failures
0 export packets were dropped due to encapsulation fixup failures
0 export packets were dropped enqueuing for the RP
0 export packets were dropped due to IPC rate limiting
and
gp1#sho mls nde
Netflow Data Export enabled
Exporting flows to xxx.139.197.76 (9800)
Exporting flows from xxx.139.220.90 (58540)
Version: 5
Layer2 flow creation is disabled
Layer2 flow export is disabled
Include Filter not configured
Exclude Filter not configured
Total Netflow Data Export Packets are:
1018492393 packets, 0 no packets, 3766475592 records
Can I be doubling exported flows? How can I tell? How can I make
it just export a flow once?
Thanks,
Hank
More information about the cisco-nsp
mailing list