[c-nsp] Flow tools

Sergey Nikitin oldnick at oldnick.ru
Wed Jan 18 07:25:55 EST 2012


Just for the record, I'v checked this (cause I do have distributed NDE and use origin-as info), and 
I can see origin AS in my flow data from 10G card with DFC. For example, 2 netflow packets with 
SrcAS/DstAS (wireshark capture, unimportant omitted, IP/AS replaced):

- Packet 1 (from 10G module with DFC - EngineId: 3):

Cisco NetFlow/IPFIX
     EngineType: 0
     EngineId: 3
pdu 1/29
         SrcAddr: 192.168.0.1 (192.168.0.1)
         DstAddr: 10.10.10.10 (10.10.10.10)
         NextHop: 172.16.0.1 (172.16.0.1)
         InputInt: 235
         OutputInt: 74
         IP ToS: 0x00
         SrcAS: 65118
         DstAS: 65119
...

- Packet 2 (from SUP720 - EngineId: 0):
    EngineType: 0
     EngineId: 0
pdu 1/29
         SrcAddr: 192.168.44.1 (192.168.44.1)
         DstAddr: 10.10.0.10 (10.10.0.10)
         NextHop: 172.16.0.1 (172.16.0.1)
         InputInt: 23
         OutputInt: 74
         IP ToS: 0x00
         SrcAS: 65120
         DstAS: 65119


Hardware: Cat6500/Sup720/WS-X6708-10GE

Phil Mayers wrote:
  > Sure. In particular, I note that on the 6500/sup720 platform, src/dst AS
> in the netflow requires lookup (and export) by the supervisor CPU; 
> distributed NDE i.e. done by the linecard CPU will not be available.



More information about the cisco-nsp mailing list