[c-nsp] Flow tools
Sergey Nikitin
oldnick at oldnick.ru
Wed Jan 18 07:25:55 EST 2012
Just for the record, I'v checked this (cause I do have distributed NDE and use origin-as info), and
I can see origin AS in my flow data from 10G card with DFC. For example, 2 netflow packets with
SrcAS/DstAS (wireshark capture, unimportant omitted, IP/AS replaced):
- Packet 1 (from 10G module with DFC - EngineId: 3):
Cisco NetFlow/IPFIX
EngineType: 0
EngineId: 3
pdu 1/29
SrcAddr: 192.168.0.1 (192.168.0.1)
DstAddr: 10.10.10.10 (10.10.10.10)
NextHop: 172.16.0.1 (172.16.0.1)
InputInt: 235
OutputInt: 74
IP ToS: 0x00
SrcAS: 65118
DstAS: 65119
...
- Packet 2 (from SUP720 - EngineId: 0):
EngineType: 0
EngineId: 0
pdu 1/29
SrcAddr: 192.168.44.1 (192.168.44.1)
DstAddr: 10.10.0.10 (10.10.0.10)
NextHop: 172.16.0.1 (172.16.0.1)
InputInt: 23
OutputInt: 74
IP ToS: 0x00
SrcAS: 65120
DstAS: 65119
Hardware: Cat6500/Sup720/WS-X6708-10GE
Phil Mayers wrote:
> Sure. In particular, I note that on the 6500/sup720 platform, src/dst AS
> in the netflow requires lookup (and export) by the supervisor CPU;
> distributed NDE i.e. done by the linecard CPU will not be available.
More information about the cisco-nsp
mailing list