[c-nsp] Another netflow question

[Oliver Boehmer (oboehmer)]

news.gmane.org <> wrote on Thursday, March 23, 2006 11:56 AM:

> Hi,
> 
> i have cisco with 2 FE interfaces. Client connected to
> FastEthernet0/0, to internet listen FastEthernet0/1. If i use config
> like it is netflow double traffic or no ?
> 
> ip flow-egress input-interface
> ip flow-cache entries 4094
> ip flow-cache timeout active 3
> !
> interface FastEthernet0/0
>   ip flow ingress
>   ip flow egress
> !
> interface FastEthernet0/1
>   ip flow ingress
>   ip flow egress
> 
> When i look sh ip cache flow i see
> 
> SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP
>   DstP Pkts
> Fa0/1         193.238.118.189 Fa0/0*        81.19.66.19     06 C76D
>      0050 4
> Fa0/1         193.238.118.189 Fa0/0         81.19.66.19     06 C76D
>      0050 4
> 
> what is marked with '*' ? Is it double packet ? Is it exported to
> collector ?

"*" denotes an output/egress flow. With your config, you will see two
flows (i.e. double the traffic). 

	oli