[c-nsp] Another netflow question

[Tassos Chatzithomaoglou]

Is there any difference between "ip flow egress" and "ip route-cache flow"?


Tassos


Oliver Boehmer (oboehmer) wrote on 23/3/2006 13:03:

> news.gmane.org <> wrote on Thursday, March 23, 2006 11:56 AM:
> 
> 
>>Hi,
>>
>>i have cisco with 2 FE interfaces. Client connected to
>>FastEthernet0/0, to internet listen FastEthernet0/1. If i use config
>>like it is netflow double traffic or no ?
>>
>>ip flow-egress input-interface
>>ip flow-cache entries 4094
>>ip flow-cache timeout active 3
>>!
>>interface FastEthernet0/0
>>  ip flow ingress
>>  ip flow egress
>>!
>>interface FastEthernet0/1
>>  ip flow ingress
>>  ip flow egress
>>
>>When i look sh ip cache flow i see
>>
>>SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP
>>  DstP Pkts
>>Fa0/1         193.238.118.189 Fa0/0*        81.19.66.19     06 C76D
>>     0050 4
>>Fa0/1         193.238.118.189 Fa0/0         81.19.66.19     06 C76D
>>     0050 4
>>
>>what is marked with '*' ? Is it double packet ? Is it exported to
>>collector ?
> 
> 
> "*" denotes an output/egress flow. With your config, you will see two
> flows (i.e. double the traffic). 
> 
> 	oli
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>