Hi All, Ever see a problem like this?
2 Cisco 6509 L3 boxes with exact same SUP and PFC cards and IOS version, netflow export is configured exactly the same as well Both in separate channels to nfsen (BTW - before I forget - Peter, Thank you - great product!) ... One Cisco box outputs netflow as expected, the other one output flows only with 0:0:0 in the proto:src port:dst port fields so I have great graphs and profiles from one channel and the other channel from my misbehaving Cisco box have all the flows lumped into "other". This is not an nfsen problem, its a Cisco problem, just asking the list if anyone has seen this before ... Good box output: GOOD_BOX_1#sh mls netflow ip destination xxx.xxx.6.32 Displaying Netflow entries in Supervisor Earl DstIP SrcIP Prot:SrcPort:DstPort Src i/f :AdjPtr ----------------------------------------------------------------------------- Pkts Bytes Age LastSeen Attributes --------------------------------------------------- xxx.xxx.6.32 xxx.xxx.20.196 icmp:8 :0 Vl20 :0x0 1 60 201 10:16:06 L3 - Dynamic xxx.xxx.6.32 xxx.xxx.0.1 tcp :31596 :5550 Vl1 :0x0 66 19427 16 10:19:25 L3 - Dynamic BAD_BOX_1#sh mls netflow ip destination xxx.xxx.6.32 Displaying Netflow entries in Supervisor Earl DstIP SrcIP Prot:SrcPort:DstPort Src i/f :AdjPtr ----------------------------------------------------------------------------- Pkts Bytes Age LastSeen Attributes --------------------------------------------------- xxx.xxx.6.32 xxx.xxx.6.36 0 :0 :0 -- :0x0 22 1507 103 10:22:11 L2 - Dynamic xxx.xxx.6.32 xxx.xxx.30.132 0 :0 :0 -- :0x0 10 1574 242 10:18:12 L3 - Dynamic Interesting problem .. suspect right now - excessive packet fragmentation at one site ... will let the list know if I find anything, but if anyone has ever seen this before please let me know. Thanks, Mike CONFIDENTIALITY NOTICE: This e-mail and any files transmitted with it are confidential and may contain health information protected by law. Any unauthorized use or disclosure is strictly prohibited. If you are not the intended recipient, please notify the sender by return email, delete this email, and destroy any copies. Please note that any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of Southcoast. The recipient should check this e-mail and any attachments for the presence of viruses. Southcoast accepts no liability for any damage caused by any virus transmitted by this e-mail. ------------------------------------------------------------------------------ Create and Deploy Rich Internet Apps outside the browser with Adobe(R)AIR(TM) software. With Adobe AIR, Ajax developers can use existing skills and code to build responsive, highly engaging applications that combine the power of local resources and data with the reach of the web. Download the Adobe AIR SDK and Ajax docs to start building applications today-http://p.sf.net/sfu/adobe-com _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
