[c-nsp] Netflow with nfsen issue

Satish Patel satish.txt at gmail.com
Tue Jul 5 16:18:56 EDT 2016


Thanks!! i tried that "collect timestamp sys-uptime first" and "last"
but didn't work,

Now i am trying to enable "NetFlow Version 5" but i am seeing
following in monitor, does v5 supported on ASR1006?

Flow Exporter:     netflow-exporter (inactive)


R1#show flow monitor netflow-monitor
Flow Monitor netflow-monitor:
  Description:       User defined
  Flow Record:       netflow-record
  Flow Exporter:     netflow-exporter (inactive)
  Cache:
    Type:                 normal (Platform cache)
    Status:               allocated
    Size:                 200000 entries
    Inactive Timeout:     15 secs
    Active Timeout:       60 secs
    Trans end aging:   off

On Sun, Jul 3, 2016 at 7:16 PM, Peter Rathlev <peter at rathlev.dk> wrote:
> On Fri, 2016-07-01 at 12:39 -0400, Satish Patel wrote:
>> I have following network configured on Cisco ASR1000 but i am seeing
>> wrong date on nfsen, does anyone experience this issue?
>>
>> Should i use ipfix or Netflow v9 ?   I did capture wireshark and its
>> showing correct date and time.
>>
>> flow record netflow-record
>>  match ipv4 destination address
>>  match ipv4 source address
>>  match transport destination-port
>>  match transport source-port
>>  match ipv4 protocol
>>  collect counter bytes
>>  collect counter packets
>
> I'm not familiar with ASR1000 but on C6k you need to add timestamp
> collection. This is our template for IPv4:
>
> flow record IPV4-FULL
>  match ipv4 tos
>  match ipv4 protocol
>  match ipv4 source address
>  match ipv4 destination address
>  match transport source-port
>  match transport destination-port
>  collect transport tcp flags
>  collect interface input
>  collect counter bytes long
>  collect counter packets long
>  collect timestamp sys-uptime first   <---
>  collect timestamp sys-uptime last    <---
> !
>
> --
> Peter
>


More information about the cisco-nsp mailing list