[c-nsp] Netflow vs NDE

[Peter Salanki]

Afaik, there are different counters for netflow exported by hardware  
and by MSFC, so "show ip flow export" is flows due to traffic being  
punted to MSFC, and "sho mls nde" is flows in hardware. Maybe it  
could be that "show ip flow export" is both software+hardware flows,  
I'm not sure.

/Peter Salanki
Bahnhof AB (AS8473)
Stockholm, Sweden

On Mar 23, 2006, at 9:51 AM, Hank Nussbacher wrote:

> I am wondering if I am double counting flows. Here is my config  
> snippet
> from a 7613 running 12.2(18)SXE4:
>
> mls flow ip interface-full
> mls nde sender version 5
> !
> ip flow-export source Loopback0
> ip flow-export version 5 origin-as
> ip flow-export destination XXX.139.197.76 9800
>
> Most interfaces look like this:
> interface Serial1/0/5
> ip route-cache flow
>
> But looking at:
>
> gp1#sho ip flow export
> Flow export v5 is enabled for main cache
> Exporting flows to xxx.139.197.76 (9800)
> Exporting using source interface Loopback0
> Version 5 flow records, origin-as
> 460190792 flows exported in 15339766 udp datagrams
> 0 flows failed due to lack of export packet
> 3 export packets were sent up to process level
> 0 export packets were dropped due to no fib
> 199 export packets were dropped due to adjacency issues
> 0 export packets were dropped due to fragmentation failures
> 0 export packets were dropped due to encapsulation fixup failures
> 0 export packets were dropped enqueuing for the RP
> 0 export packets were dropped due to IPC rate limiting
>
> and
>
> gp1#sho mls nde
> Netflow Data Export enabled
> Exporting flows to xxx.139.197.76 (9800)
> Exporting flows from xxx.139.220.90 (58540)
> Version: 5
> Layer2 flow creation is disabled
> Layer2 flow export is disabled
> Include Filter not configured
> Exclude Filter not configured
> Total Netflow Data Export Packets are:
> 1018492393 packets, 0 no packets, 3766475592 records
>
> Can I be doubling exported flows? How can I tell? How can I make
> it just export a flow once?
>
> Thanks,
> Hank
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/