[c-nsp] Netflow issue

Hank Nussbacher hank at efes.iucc.ac.il
Mon Oct 29 07:52:34 EDT 2012


We used to collect full unsampled Netflow from two 7613 routers.  Both ran
12.2(18)SXF11 and all was well.

We continue to get flow data as follows from the 12.2(18)SXF router:
Flow export v5 is enabled for main cache
   Exporting flows to xxx.139.197.76 (9800) xx.229.0.7 (8888)
   Exporting using source interface Loopback0
   Version 5 flow records, origin-as
   35057147 flows exported in 1168572 udp datagrams

We upgraded the other 7613 to 12.2(33)SRE6 - and most of the flow data no 
longer appears in our collector.  Yet:
gp1#sho ip flow export
Flow export v5 is enabled for main cache
   Export source and destination details :
   VRF ID : Default
     Source(1)       xxx.139.220.90 (Loopback0)
     Destination(1)  xxx.139.197.76 (9800)
   Version 5 flow records, origin-as
   28312144 flows exported in 943738 udp datagrams
It appears like we should be getting flow data but we are not.

We have a very simple Netflow setup.  On most GigE and 10GigE interfaces we 
have defined:
ip flow ingress
and globally we have defined:
ip flow-cache entries 120000
mls flow ip interface-full

This used to work pre-12.2(33)SRE.  Something must have changed that we are 
not aware of that needs to be defined.  Any ideas?

Thanks,
Hank



More information about the cisco-nsp mailing list