[c-nsp] Netflow with nfsen issue

Satish Patel satish.txt at gmail.com
Fri Jul 1 12:39:36 EDT 2016


I have following network configured on Cisco ASR1000 but i am seeing
wrong date on nfsen, does anyone experience this issue?

Should i use ipfix or Netflow v9 ?   I did capture wireshark and its
showing correct date and time.

flow record netflow-record
 match ipv4 destination address
 match ipv4 source address
 match transport destination-port
 match transport source-port
 match ipv4 protocol
 collect counter bytes
 collect counter packets
!
!
flow exporter netflow-exporter
 description Vivox-Netflow-Exporter
 destination xx.xx.xx.xx
 source TenGigabitEthernet0/0/0
 transport udp 9995
 export-protocol ipfix
!
!
flow monitor netflow-monitor
 exporter netflow-exporter
 cache timeout active 60
 record netflow-record



On nfdump i am seeing this.

[root at netflow 30]# nfdump -M /data/nfsen/profiles-data/live/r1  -T  -r
nfcapd.201606301715 -a -c 10
Date first seen          Duration Proto      Src IP Addr:Port
Dst IP Addr:Port   Packets    Bytes Flows
1969-12-31 19:00:00.000     0.000     0    176.61.183.77:0     ->
xx.xx.xx.98:0           56     2688     1
1969-12-31 19:00:00.000     0.000     0    187.23.16.207:0     ->
xx.xx.xx.171:0           81     2349     1
1969-12-31 19:00:00.000     0.000     0    187.23.16.207:0     ->
xx.xx.xx.39:0            2       58     1
1969-12-31 19:00:00.000     0.000     0    187.23.16.207:0     ->
xx.xx.xx.239:0           81     2349     1
1969-12-31 19:00:00.000     0.000     0    169.228.66.91:0     ->
xx.xx.xx.62:0            1       40     1


More information about the cisco-nsp mailing list