cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2220
Views
0
Helpful
2
Replies

1506 byte netflow packet from a 1500 mtu router

acid_kewpie
Level 1
Level 1

Hi,

I've been battling with an annoying problem where netflow v9 data from a 3725 router has been going awol when it reaches my F5 load balancers. what i have come down to is finding that the F5 boxes are rejecting the UDP packets as they have a size of 1506 bytes, compared to their MTU of 1500, and i can now see icmp host unreachable messages going back to the router to this effect. but the 3725 router itself is also configured, according to the snmp if table (as that's all i can see... the router is hosted for us) that the fa0.1 interface which is connect to our LAN also has an MTU of 1500, that that device is apparently creating packets of 1506 itself (i've verified this by directly spanning that switch port and capturing data right from it). From what i understand my load balancer is totally correct to reject the packet as it is 6 bytes too big.

what's going on?

2 Replies 2

Jan Nejman
Level 3
Level 3

Hello,

it is really very strange. I saw the longest netflow packet 1496 bytes long. In any case netflow export is not supported by Cisco on this device type. (*NetFlow is not supported on 35xx and 37xx devices). Is the value 1506B a L2 or L3 packet size? It looks that you are using a trunk, so maybe it is that problem (size of packet is incremented due to 802.1q... I don't know.) Did you test what happens when you decrease MTU on 3725?

Please, let me know, I'm personally interested in any solution.

Kind regards,

Jan Nejman

Caligare Co.

http://www.caligare.com/

netflow definitely is supported, we are using it. maybe you're thinking of 3560 and 3750 catalyst switches not routers?

1506 is the L2 frame size, the L3 packet is 1464 bytes, and there is no trunk, just a single access port.

thanks

Chris