WLC 5508 with 7.4.100.0 - Netflow exporting HOPOPT protocol?

patrick.kofler · ‎12-20-2012

Hi all,

I am currently toying around with the new release and now I want to try out the netflow feature of the WLC.

I have already setup the monitor as well as an exporter. I also used the default flow record, which is actually the only one.

When I now check the data in my netflow application I only see packets with no valid source and destination IP address and with protocol 0, HOPOPT.

Is there any way to 'decode' this traffic or telling the controller to send the TCP/UDP protocol?

Regards,

Patrick

jakewilson · ‎12-21-2012

Hi Patrick,

Most NetFlow reporting tools expect a traditional flow tuple else they can't display the data.

If you can get a packet capture to me WITH THE TEMPLATE, I can replay it in our lab and build you some reports in Scrutinizer.

Jake Wilson

NetFlow Knight

rizwanr74 · ‎03-01-2014

Dear Jake,

Scrutinizer is extremely expensive like out of this World and they want to be millionair over night.

thanks

Mat Barry · ‎10-07-2014

Compared to "Free", yeah. But you get what you pay for. It's still much less than quite a few other solutions such as Fluke, HP, and others.

Rasika Nayanajith · ‎03-01-2014

Hi Patrick,

WLC Netflow is NOT standard netflow, so you cannot use any netflow tools to decode it. As far as I know, Scrutinizer & Cisco Prime Assurance are the one you have to use. See below posts for more detail

http://mrncciew.com/2013/02/13/who-really-support-wlc-netflow/

http://mrncciew.com/2013/02/12/configuring-netflow-on-wlc-7-4/

On a side note, Cisco has deffered ALL software codes except 7.0MR5 (7.0.250.0), 7.4MR2 (7.4.121.0) & 7.6.x. So move onto 7.4MR2 in order to get TAC support.

http://mrncciew.com/2014/02/28/are-you-on-right-wlc-software-version/

HTH

Rasika

*** Pls rate all useful responses ****