Just for the record, I'v checked this (cause I do have distributed NDE and use origin-as info), and
I can see origin AS in my flow data from 10G card with DFC. For example, 2 netflow packets with
SrcAS/DstAS (wireshark capture, unimportant omitted, IP/AS replaced):
- Packet 1 (from 10G module with DFC - EngineId: 3):
Cisco NetFlow/IPFIX
EngineType: 0
EngineId: 3
pdu 1/29
SrcAddr: 192.168.0.1 (192.168.0.1)
DstAddr: 10.10.10.10 (10.10.10.10)
NextHop: 172.16.0.1 (172.16.0.1)
InputInt: 235
OutputInt: 74
IP ToS: 0x00
SrcAS: 65118
DstAS: 65119
...
- Packet 2 (from SUP720 - EngineId: 0):
EngineType: 0
EngineId: 0
pdu 1/29
SrcAddr: 192.168.44.1 (192.168.44.1)
DstAddr: 10.10.0.10 (10.10.0.10)
NextHop: 172.16.0.1 (172.16.0.1)
InputInt: 23
OutputInt: 74
IP ToS: 0x00
SrcAS: 65120
DstAS: 65119
Hardware: Cat6500/Sup720/WS-X6708-10GE
Phil Mayers wrote:
> Sure. In particular, I note that on the 6500/sup720 platform, src/dst AS
in the netflow requires lookup (and export) by the supervisor CPU;
distributed NDE i.e. done by the linecard CPU will not be available.
_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
