[c-nsp] 6500 not exporting layer 2 netflow data (RESOLVED)
    Andy Ellsworth 
    andy at dar.net
       
    Wed Apr 30 14:52:04 EDT 2008
    
    
  
Aaron Fabiani wrote:
> Try adding:
>
> mls flow ip interface-full
>   
Aaron just sent me the above suggestion privately (thanks Aaron!), and 
it's looking like that did the trick. Previously I was just using "mls 
flow ip full". Here's a sample netflow PDU containing a bridged flow, 
fresh off the wire from tshark:
    pdu 19/29
        SrcAddr: 10.103.253.92 (10.103.253.92)
        DstAddr: 10.100.253.210 (10.100.253.210)
        NextHop: 10.100.253.210 (10.100.253.210)
        InputInt: 79
        OutputInt: 79
        Packets: 5
        Octets: 285
        [Duration: 0.320000000 seconds]
            StartTime: 1905523.192000000 seconds
            EndTime: 1905523.512000000 seconds
        SrcPort: 21
        DstPort: 40508
        padding
        TCP Flags: 0x00
        Protocol: 6
        IP ToS: 0x00
        SrcAS: 0
        DstAS: 0
        SrcMask: 0 (prefix: 10.103.253.92/32)
        DstMask: 24 (prefix: 10.100.253.0/24)
        padding
My relevant config bits currently look like this:
ip flow ingress layer2-switched vlan <vlan list>
mls ip multicast flow-stat-timer 9
mls aging long 300
mls aging normal 60
mls netflow usage notify 80 300
mls flow ip interface-full
no mls flow ipv6
mls nde sender version 5
no mls acl tcam share-global
ip flow-export source <source interface>
ip flow-export version 5
ip flow-export destination <netflow collector IP> <UDP port>
! sample SVI config to capture bridged flows from vlan XYZ
interface vlanXYZ
 ip address x.x.x.x y.y.y.y
 ip route-cache flow
end
Thanks again for everyone's assistance.
-Andy
    
    
More information about the cisco-nsp
mailing list