[c-nsp] ASR Netflow Query

[Rodney Dunn]

Roddy,

Do you see a corresponding match for the frame mapped to the VAI
for the user?

Or are those OSPF hellos coming from OSPF neighbors directly
attached to the g0/1/0.1 subinterface?

Can you provide the output with the column headers?


Rodney

On Mon, Sep 15, 2008 at 02:46:14PM +1000, Roddy Strachan wrote:
> Hey all,
> 
> Been playing around with an ASR1004 for terminating L2TP sessions.
> 
> One thing I?ve noticed that shows up in a cache flow output is the following
> :
> 
> gi0/1/0.1     x.x.x.x  RP0_Punt      224.0.0.5       59 0000 0000  17
> gi0/1/0.1     x.x.x.x  RP0_Punt      224.0.0.5       59 0000 0000  17
> gi0/1/0.1     x.x.x.x  RP0_Punt      224.0.0.5       59 0000 0000  608
> gi0/1/0.1     x.x.x.x  RP0_Punt      224.0.0.5       59 0000 0000  17
> gi0/1/0.1     x.x.x.x  RP0_Punt      224.0.0.5       59 0000 0000  198
> 
> That in turn fills up our flow files on the collectors with data looking
> like this :
> 
> 1221452253 x.x.x.x x.x.x.x 0 224.0.0.5 0 12740 2 0 0 0
> 1221452255 x.x.x.x x.x.x.x 0 224.0.0.5 0 11648 2 0 0 0
> 1221452259 x.x.x.x x.x.x.x 0 224.0.0.5 0 12740 2 0 0 0
> 1221452260 x.x.x.x x.x.x.x 0 224.0.0.5 0 12740 2 0 0 0
> 
> 
> I don?t see this type of behaviour on the 7200/7300 platform doing the same
> type of thing for L2TP sessions.
> 
> >From what I understand its a multicast broadcast for OSPF (correct me if I?m
> wrong).
> 
> Is there anyone to turn this off so it doesn?t show up in the  ?sh ip cache
> flow? output ? Therefor not filling up out collector with unnecessary
> information
> 
> Thanks
> 
> 
> 
> This email and any files transmitted with it are confidential and intended
>  solely for the use of the individual or entity to whom they are addressed. 
> Please notify the sender immediately by email if you have received this 
> email by mistake and delete this email from your system. Please note that
>  any views or opinions presented in this email are solely those of the
>  author and do not necessarily represent those of the organisation. 
> Finally, the recipient should check this email and any attachments for 
> the presence of viruses. The organisation accepts no liability for any 
> damage caused by any virus transmitted by this email.
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/