Netflow problem on catalyst 4500 supV-10GE

Unanswered Question
Apr 11th, 2008

Hi

I've got netflow set up on a catalyst 4500 with a supervisor V-10GE. It's dumping data to my collector but the flows look very weird, most of the flows have very high durations...

duration for most flows are all 4294952.292 seconds. UPD, ICMP and TCP sesions... some flows have 0s duration, and a few look normal.

In addition there a no tcp flags on the "weird" TCP sessions.

I'm exporting netflow version 5 dumped to nfdump. Netflow from a couple of other routers look ok, so i'm guessing it's not the collector...

using sw version 12.2(37)SG1

anyone have any ideas?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Jan Nejman Mon, 04/14/2008 - 01:38

Hello,

it could be a problem with collector. You can use our public collector to test it if it is acceptable for you. Please, let me know on my email, and we can try some debugs...

Kind regards

Jan Nejman

nejman (at) caligare (dot) com

Caligare, Co.

http://www.caligare.com/

axel.thirud Mon, 04/14/2008 - 23:13

thx for the tip, but it's not the collector.

i dumped the packets from my two routers with tcpdump and had a look at the in wireshark, which has a cflow decoder

On the router that works, a sample packet has a start time of:

ba:dd:cf:78 - 3135098.744s

end:

ba:dd:cf:88 - 3135098.760s

on the cat4500, it's travelling in time:

start:

97:8b:24:4c - 2542478.412s

end

97:8a:e9:b4 - 2542463.412s

it's ending before it's starting.

I have tried turning netflow off and on again on the router, no luck... next step restarting the router or upgrading ios i suppose...

regards

axel

Jan Nejman Tue, 04/15/2008 - 01:11

Oops, it's not good. I solved similar problem, but corrupted time was only from two line-cards. Try enable ntp with option update-calendar. Maybe it helps.

It is a very interesting bug, please, could you send me result if reboot or IOS upgrade helps? I'm personally interest in the right solution.

Kind regards,

Jan

axel.thirud Mon, 04/28/2008 - 02:24

I upgraded the ios to the latest version and restarted the box. This seems to have fixed the problem.

thx for your help

regards

axel

Actions

This Discussion