I've confirmed that the AS information is definitely in the packet. I added the origin-as command, still AS 0. Now I've added the peer-as command, again AS 0.
root@ares:/storage/nfsen/profiles-data/live/edge1-syd# nfdump -M /storage/nfsen/profiles-data/live/edge1-syd -T -r 2014/08/12/nfcapd.201408120000 -n 10 -s prevas/flows Unknown stat: 'prevas/flows'! root@ares:/storage/nfsen/profiles-data/live/edge1-syd# nfdump -M /storage/nfsen/profiles-data/live/edge1-syd -T -r 2014/08/12/nfcapd.201408120000 -n 10 -s nextas/flows Unknown stat: 'nextas/flows'! root@ares:/storage/nfsen/profiles-data/live/edge1-syd# nfdump -M /storage/nfsen/profiles-data/live/edge1-syd -T -r 2014/08/12/nfcapd.201408120000 -n 10 -s srcas/flows Top 10 Src AS ordered by flows: Date first seen Duration Proto Src AS Flows(%) Packets(%) Bytes(%) pps bps bpp 2014-08-11 23:55:01.837 596.843 any 0 18660(100.0) 341444(100.0) 133.0 M(100.0) 572 1.8 M 389 Summary: total flows: 18660, total bytes: 133.0 M, total packets: 341444, avg bps: 1.8 M, avg pps: 572, avg bpp: 389 Time window: 2014-08-11 23:55:01 - 2014-08-12 00:04:58 Total flows processed: 18660, Blocks skipped: 0, Bytes read: 970360 Sys: 0.008s flows/second: 2332500.0 Wall: 0.008s flows/second: 2264838.0 root@ares:/storage/nfsen/profiles-data/live/edge1-syd# nfdump -M /storage/nfsen/profiles-data/live/edge1-syd -T -r 2014/08/12/nfcapd.201408120000 -n 10 -s dstas/flows Top 10 Dst AS ordered by flows: Date first seen Duration Proto Dst AS Flows(%) Packets(%) Bytes(%) pps bps bpp 2014-08-11 23:55:01.837 596.843 any 0 18660(100.0) 341444(100.0) 133.0 M(100.0) 572 1.8 M 389 Summary: total flows: 18660, total bytes: 133.0 M, total packets: 341444, avg bps: 1.8 M, avg pps: 572, avg bpp: 389 Time window: 2014-08-11 23:55:01 - 2014-08-12 00:04:58 Total flows processed: 18660, Blocks skipped: 0, Bytes read: 970360 Sys: 0.008s flows/second: 2332500.0 Wall: 0.008s flows/second: 2211162.5 Anything else you can think off I can check ? Cheers. On Tue, Aug 12, 2014 at 12:38 PM, geebs <[email protected]> wrote: > Thanks for your response Mark, I only have ip flow-export version 5 > configured. > I'll check the flow data to confirm. > Thanks very much for your response. > > > > On Tue, Aug 12, 2014 at 12:31 PM, Mark van der Meulen <[email protected]> > wrote: > >> Looks like your routers are not including the AS information in the >> Netflow packet. What is your router configuration? For some cisco you need >> 'ip flow-export version 5 origin-as’ I think it is – as opposed to peer-as. >> I’d be checking the flow data first to confirm you are actually seeing AS >> information in the packets and if not, work backwards from there; >> otherwise, if the data is in the packet you might need to be checking >> something different. Have you tried srcas, nextas , prevas for the sake >> of troubleshooting? >> >> Mark >> >> From: geebs <[email protected]> >> Date: Tuesday, 12 August 2014 12:17 pm >> To: "[email protected]" < >> [email protected]> >> Subject: [Nfsen-discuss] DST AS 0 - no other AS listed >> >> Hello, >> >> I'm trying to get a list of my networks top destination AS's. >> However I'm not getting far, I'm sure it's something I'm not seeing. >> >> All my routers are exporting v5 netflow correctly. >> >> All I see is 100% of traffic to AS 0 ??? >> >> Here's the response I get; >> >> ** nfdump -M >> /storage/nfsen/profiles-data/live/core2-bri:edge1-syd:edge2-mel:core2-mel:edge1-mel:core1-bri:core1-mel:core1-per:edge2-syd:edge1-bri:core1-syd:core2-per:core2-syd:edge1-per >> -T -r 2014/08/12/nfcapd.201408120000 -n 10 -s dstas/flows >> nfdump filter: >> any >> Top 10 Dst AS ordered by flows: >> Date first seen Duration Proto Dst AS Flows(%) >> Packets(%) Bytes(%) pps bps bpp >> 2014-08-11 23:54:58.720 600.031 any 0 270445(100.0) >> 6.0 M(100.0) 3.4 G(100.0) 9953 45.6 M 573 >> >> Summary: total flows: 270445, total bytes: 3.4 G, total packets: 6.0 M, >> avg bps: 45.6 M, avg pps: 9953, avg bpp: 573 >> Time window: 2014-08-11 23:54:58 - 2014-08-12 00:04:58 >> Total flows processed: 270445, Blocks skipped: 0, Bytes read: 14063784 >> Sys: 0.100s flows/second: 2704314.8 Wall: 0.099s flows/second: 2728460.5 >> >> Thanks for your time. >> >> >
------------------------------------------------------------------------------
_______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
