Hello all,
I'm running nfdump: Version: 1.6.6 $Date: 2012-03-11 11:57:45 +0100 (Sun,
11 Mar 2012) $ in a production environment and we started our first test to
export netflow v9 data from a Cisco CRS device including MPLS labels.
I checked the netflow export and the labels are part of the flowrecord:
Flow 11
MPLS-Label1: 16060 exp-bits: 0 top-of-stack
MPLS-Label2: 0 exp-bits: 0
MPLS-Label3: 0 exp-bits: 0
MPLS-Label4: 0 exp-bits: 0
MPLS-Label5: 0 exp-bits: 0
MPLS-Label6: 0 exp-bits: 0
InputInt: 33
OutputInt: 28
Octets: 130
Packets: 2
[Duration: 0.231000000 seconds]
StartTime: 3352283.137000000 seconds
EndTime: 3352283.368000000 seconds
TopLabelAddr: 0.0.0.0 (0.0.0.0)
SrcAddr: 86.34.xx.xx (86.34.xx.xx)
DstAddr: 92.87.xx.xx (92.87.xx.xx)
SrcPort: 2759
DstPort: 443
Mpls Top Label Prefix Length: 0
TopLabelType: Unknown (0)
Forwarding Status: Forward: Forwarded not Fragmented
01.. .... = ForwdStat: Forward (1)
..00 0010 = ForwdCode: Forwarded not Fragmented (2)
Direction: Egress (1)
Protocol: 6
IP ToS: 0x00
TCP Flags: 0x10
SamplerID: 1
However, the records saved by nfcapd don't store the mpls labels (different
flow from the same router):
Flow Record:
Flags = 0x06 Unsampled
size = 60
first = 1396343455 [2014-04-01 12:10:55]
last = 1396343455 [2014-04-01 12:10:55]
msec_first = 55
msec_last = 55
src addr = 86.34.xx.xx
dst addr = 65.54.xx.xx
src port = 64433
dst port = 25
fwd status = 66
tcp flags = 0x10 .A....
proto = 6
(src)tos = 32
(in)packets = 1
(in)bytes = 56
input = 10
output = 28
Do I need to enable something specific in my nfsen config file to store the
mpls records as well? The router was newly added so it got the mpls records
from the begining.
This is the current config:
'CRS' => { 'port' => '9966', 'col' => '#00ff00', 'type' => 'netflow' },
Thanks!
------------------------------------------------------------------------------
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
