[c-nsp] 6500 not exporting layer 2 netflow data

Andy Ellsworth andy at dar.net
Tue Apr 29 12:37:32 EDT 2008


Tassos Chatzithomaoglou wrote:
> If i understand correctly, you're doing netflow for bridged IP traffic.
Correct.
> If yes, do you have a a corresponding VLAN interface with an IP 
> address as the one you're gathering netflow data from?
I did come across that requirement (and it gave me quite a headache 
until I found it outlined in the docs), but yes - I do have an SVI 
configured, with an IP address, in the VLAN(s) I'm interested in. If I 
didn't have that configured, I don't believe I'd see any corresponding 
layer 2 flows in my "show mls netflow ip" output.
> Maybe posting your mls/flow config would help a little more.
Here's the relevant snippets. For the purposes of this discussion, I'm 
mostly interested in traffic on VLAN 201:

mls aging long 300
mls aging normal 60
mls flow ip full
no mls flow ipv6
mls nde sender
ip flow ingress layer2-switched vlan 1,18,201,253-254
ip flow-export source Vlan253
ip flow-export version 5
ip flow-export destination 10.100.253.210 30002
interface Vlan201
 ip address 10.100.201.249 255.255.255.0
 ip route-cache flow
end

Note that the "ip flow export layer2-switched vlan" command does not 
show up in a "show run" output, since export is implicitly enabled along 
with the "ip flow ingress" command.

-Andy



More information about the cisco-nsp mailing list