[c-nsp] Another netflow question

[Oliver Boehmer (oboehmer)]

Well, one collects flows in ingress (ip route-cache flow), one in egress
direction.

	oli

Tassos Chatzithomaoglou <mailto:achatz at forthnet.gr> wrote on Friday,
March 24, 2006 12:29 PM:

> Is there any difference between "ip flow egress" and "ip route-cache
> flow"? 
> 
> 
> Tassos
> 
> 
> Oliver Boehmer (oboehmer) wrote on 23/3/2006 13:03:
> 
>> news.gmane.org <> wrote on Thursday, March 23, 2006 11:56 AM:
>> 
>> 
>>> Hi,
>>> 
>>> i have cisco with 2 FE interfaces. Client connected to
>>> FastEthernet0/0, to internet listen FastEthernet0/1. If i use config
>>> like it is netflow double traffic or no ?
>>> 
>>> ip flow-egress input-interface
>>> ip flow-cache entries 4094
>>> ip flow-cache timeout active 3
>>> !
>>> interface FastEthernet0/0
>>>  ip flow ingress
>>>  ip flow egress
>>> !
>>> interface FastEthernet0/1
>>>  ip flow ingress
>>>  ip flow egress
>>> 
>>> When i look sh ip cache flow i see
>>> 
>>> SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP
>>> DstP Pkts Fa0/1         193.238.118.189 Fa0/0*        81.19.66.19  
>>> 06 C76D     0050 4 Fa0/1         193.238.118.189 Fa0/0        
>>> 81.19.66.19     06 C76D     0050 4 
>>> 
>>> what is marked with '*' ? Is it double packet ? Is it exported to
>>> collector ?
>> 
>> 
>> "*" denotes an output/egress flow. With your config, you will see two
>> flows (i.e. double the traffic).
>> 
>> 	oli
>> 
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/