I'm seeing some odd output on my netflow collector which is regurgitating data
exported to it from a particular 7609 on my network. I have a second 7609
running the same hardware configuration as what you will see below, only it's
running a special build of 12.2SRE (TAC approved ;)), and it's working fine.
When I do something like look at the top 10 any AS output on my collector, I
see some confusing data. First, the date range I've specified starts at 8:10am
and ends at 8:30am, but the output shows flows first seen almost two months
prior. Second, the time window shown in the summary is over 3 months, but I've
only got 2 hours worth of data on this box to begin with. Third, seeing things
like 1 flow consisting of 1 packet, which is 28.4MB in size - well, that's
preposterous. Any of this look familiar to anyone, by chance? Perhaps I need
to steer away from v9, considering at this point I'm only interested in as-as
traffic?
!
ip flow-export source Loopback0
ip flow-export version 9 origin-as
ip flow-aggregation cache as
export version 9
export destination 10.219.50.253 10002
enabled
!
interface <all-routed-and-vlan-interfaces>
ip flow ingress
!
** nfdump -M /usr/local/var/nfsen/profiles-data/live/pe01-151front01 -T -R
2011/03/09/nfcapd.201103090810:2011/03/09/nfcapd.201103090830 -n 10 -s as/bps
nfdump filter:
any
Top 10 AS ordered by bps:
Date first seen Duration Proto AS Flows(%)
Packets(%) Bytes(%) pps bps bpp
2011-01-25 01:59:28.848 0.001 any 53 1( 0.0) 3.7
G( 1.7) 3.7 G( 1.7) 1.5 G 3.6 G 1
2011-01-25 01:59:28.721 0.079 any 9704 1( 0.0)
1( 0.0) 28.4 M( 0.0) 12 2.9 G 28442624
2011-01-25 01:59:28.848 0.005 any 105 1( 0.0) 3.7
G( 1.7) 3.7 G( 1.7) 304.0 M 2.4 G 1
2011-01-25 01:59:28.721 0.061 any 8876 1( 0.0)
1( 0.0) 6.6 M( 0.0) 16 859.5 M 6553600
2011-01-25 01:59:28.721 0.065 any 9384 1( 0.0)
1( 0.0) 6.8 M( 0.0) 15 838.9 M 6815744
2011-01-25 01:59:28.721 0.083 any 8132 1( 0.0)
1( 0.0) 6.9 M( 0.0) 12 663.3 M 6881280
2011-01-25 01:59:28.721 0.061 any 8428 1( 0.0)
1( 0.0) 4.8 M( 0.0) 16 636.0 M 4849664
2011-03-09 08:13:26.996 0.004 any 26404 3( 0.0)
260( 0.0) 277400( 0.0) 64999 554.8 M 1066
2011-01-25 01:59:29.005 0.051 any 385 1( 0.0)
1( 0.0) 3.5 M( 0.0) 19 544.9 M 3473493
2011-03-09 08:22:31.996 0.004 any 33252 2( 0.0)
186( 0.0) 224579( 0.0) 46499 449.2 M 1207
Summary: total flows: 1336260, total bytes: 221.5 G, total packets: 214.3 G,
avg bps: 220529, avg pps: 26672, avg bpp: 1
Time window: 2010-12-06 08:56:44 - 2011-03-09 08:33:41
Total flows processed: 1336260, Blocks skipped: 0, Bytes read: 69486572
Sys: 0.324s flows/second: 4119631.0 Wall: 0.321s flows/second: 4155683.4
Here's a hardware snapshot.
Mod Port Model Serial # Versions
---- ---- ------------------ ----------- -------------------------------------
1 24 WS-X6724-SFP XXXXXXXXXXX Hw : 2.3
Fw : 12.2(14r)S5
Sw : 12.2(33)SRC4
Sw1: 8.7(0.22)SRC17
WS-F6700-CFC XXXXXXXXXXX Hw : 2.0
2 48 WS-X6748-GE-TX XXXXXXXXXXX Hw : 3.4
Fw : 12.2(18r)S1
Sw : 12.2(33)SRC4
Sw1: 8.7(0.22)SRC17
WS-F6700-DFC3BXL XXXXXXXXXXX Hw : 5.5
3 4 WS-X6704-10GE XXXXXXXXXXX Hw : 2.6
Fw : 12.2(14r)S5
Sw : 12.2(33)SRC4
Sw1: 8.7(0.22)SRC17
WS-F6700-CFC XXXXXXXXXXX Hw : 2.0
5 2 WS-SUP720-3BXL XXXXXXXXXXX Hw : 4.5
Fw : 8.4(2)
Sw : 12.2(33)SRC4
Sw1: 8.7(0.22)SRC17
WS-SUP720 XXXXXXXXXXX Hw : 2.6
Fw : 12.2(17r)S4
Sw : 12.2(33)SRC4
WS-F6K-PFC3BXL XXXXXXXXXXX Hw : 1.7
6 2 WS-SUP720-3BXL XXXXXXXXXXX Hw : 5.3
Fw : 8.4(2)
Sw : 12.2(33)SRC4
Sw1: 8.7(0.22)SRC17
WS-SUP720 XXXXXXXXXXX Hw : 2.6
Fw : 12.2(17r)S4
Sw : 12.2(33)SRC4
WS-F6K-PFC3BXL XXXXXXXXXXX Hw : 1.8
7 20 7600-ES20-GE3CXL XXXXXXXXXXX Hw : 1.2
Fw : 12.2(33r)SRB2
Sw : 12.2(33)SRC4
Sw1: 12.2(33)SRC4
7600-ES20-D3CXL XXXXXXXXXXX Hw : 1.0
7/0 10 7600-ES20-20GE XXXXXXXXXXX Hw : 1.1
Fw : 1.1 (I/O FPGA)
7/1 10 7600-ES20-20GE XXXXXXXXXXX Hw : 1.1
Fw : 16961.19524 (I/O FPGA)
8 24 WS-X6724-SFP XXXXXXXXXXX Hw : 2.4
Fw : 12.2(14r)S5
Sw : 12.2(33)SRC4
Sw1: 8.7(0.22)SRC17
WS-F6700-CFC XXXXXXXXXXX Hw : 2.1
ip flow-export source Loopback0
ip flow-export version 9 origin-as
ip flow-aggregation cache as
export version 9
export destination 10.219.50.253 10002
enabled
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
