[c-nsp] Counters for null0?

[Roland Dobbins]

On Aug 5, 2009, at 9:01 PM, luismi wrote:

> So "null" value must be related with NAT or something similar.

Most Cisco routers (the main exceptions being 6500/7600/4500 switches,  
with their well-known NetFlow caveats regarding dropped traffic) show  
the destination ifindex as 0 when the traffic's being dropped (ACL,  
uRPF, PBR, QoS, et. al.) or when the traffic is being intercepted by a  
software feature such as NAT or WCCP - in other words, when the RP  
doesn't know where the packet is going to end up.

In most scenarios, this is because traffic is being dropped.  But if  
you're running NAT on this box, it's a good bet that a lot of what  
you're seeing is traffic being NATted and you can sh ip nat trans to  
verify that.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton