Not seeing certain traffic in NetFlow cache

Unanswered Question
Dec 4th, 2007
User Badges:
  • Gold, 750 points or more

Could anyone explain why I do not see the pretty constant traffic between a remote IP camera and the backend in NetFlow cache, but I do see the icmp traffic once I ping the camera?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Jan Nejman Tue, 12/04/2007 - 11:50
User Badges:
  • Bronze, 100 points or more

Hello,


1. Where are you checking netflow traffic? On the collector or on the router via show ip cache)


2. Did you enable netflow on all interfaces? If you have 6500/7600 also enable mls nde ...


Kind regards,


Jan Nejman

Caligare, Co.

http://www.caligare.com/


yjdabear Tue, 12/04/2007 - 12:58
User Badges:
  • Gold, 750 points or more

I'm looking both on the router and on the collector (GUI). On the router, I'm using "show ip cache verbose flow" and "show mls netflow ip [source/destination]", which show the icmp traffic as soon as I start pinging.


NetFlow is enabled on all interfaces, and in both software and hardware cache.

Jan Nejman Tue, 12/04/2007 - 13:31
User Badges:
  • Bronze, 100 points or more

If I clearly understand, you are able to see icmp pings on your router but not in collector GUI. Is it correct? Could you send me output of the:

show runn | inc mls

show runn | inc flow


Thank you,


Jan Nejman

Caligare, Co.


yjdabear Wed, 12/05/2007 - 11:22
User Badges:
  • Gold, 750 points or more

Jan,


You misunderstood. I see icmp pings (generated by myself) on both the router and the collector GUI. The problem is I don't see the alleged video traffic on either the router or the collector.


show runn | inc mls

...

mls aging fast threshold 64

mls aging long 128

mls aging normal 64

mls flow ip interface-full

no mls flow ipv6

mls nde sender version 5

...


show runn | incl flow

...

ip flow-cache timeout inactive 64

ip flow-cache timeout active 3

mls flow ip interface-full

no mls flow ipv6

ip route-cache flow

(repeat for each interface)...

ip route-cache flow

ip flow-export source Loopback0

ip flow-export version 5

ip flow-export destination xx.xx.xx.xx 9###


Actions

This Discussion