Netflow failures - Adjacency issues?

samwharton29 · ‎10-21-2009

I am not receiving any flows from any of my netflow sources. I can see on the debug ip netflow export that there are adjacency failures?

The strangest thing is that I can see on wireshark that flows are being sent to the Netflow receiver but immediately an icmp is sent back with INCORRECT HEADER CHECKSUM. All routers and switches have this same issue??

I'm using manage engine software.

Sam

I've added screenshot.

Jan Nejman · ‎10-21-2009

Hello,

ICMP is not sending "incorrect header checksum" but port unreachable... this means that on the destination port is not listing collector. Do you have a ME running? In the ME configuration you can setup on which ports will listen...

Ad to "debug ip flow":

I think that you can ignore this message.

But you can clear adjacency tables via:

"clear adjacency"

or show current state via:

"show adjacency [detail]"

The main problem is that the analyzer/collector is not running or listening on port 9996.

Kind regards,

Jan Nejman

Caligare, Co.

http://www.caligare.com/

samwharton29 · ‎10-21-2009

I fixed this issue.

It turned out to be a conflict with the Gigabit nic card on the netflow receiver. I went into advanced settings and took off tcp checksum for headers etc.

All works fine now.

Sam