Hello,
We are using nfsen 1.3.6p1 with nfdump 1.6.6 (on CentOS 5) with great
success (thank you).
We have just upgraded two Cisco 3825 routers from IOS version 12.4(9)T2
to 12.4(24)T8 (Advanced Enterprise).
Until now (with v12.4(9)T2), netflow was working fine in nfsen.
With the new version we were seeing very strange behavior. Stats were
not correct.
I followed directions I found on the Internet and changed from standard
(old-fashioned) netflow export to "Flexible Netflow" and now stats seem
to be correct, EXCEPT Packet Stats.
Packet Stats seem to be magnified by a very large factor, est. at
100,000 (100K). That is, when the real packet traffic is at 100
packets/sec, the stats show it as 10M/s (approximate estimation)!
Can you please help me in identifying the cause of this behavior and
suggest a solution?
I've tried my best until now, but I'm at a loss.
I will send to Peter directly a zip file with a full (5 min) capture
from our two routers, hoping it will help in tracing the problem.
For reference here is the current config:
flow exporter IPv6
destination 195.251.xxx.xxx
source Loopback0
transport udp 9995
!
flow exporter IPv4
destination 195.251.xxx.xxx
source Loopback0
!
flow monitor IPv6
record netflow ipv6 original-output
exporter IPv6
transport udp 9995
!
flow monitor IPv4
record netflow ipv4 original-output
exporter IPv4
!
And on each interface:
ip flow monitor IPv4 input
ipv6 flow monitor IPv6 input
Thanks in advance,
Nick
------------------------------------------------------------------------------
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
