cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
838
Views
0
Helpful
4
Replies

Netflow problem on catalyst 4500 supV-10GE

axel.thirud
Level 1
Level 1

Hi

I've got netflow set up on a catalyst 4500 with a supervisor V-10GE. It's dumping data to my collector but the flows look very weird, most of the flows have very high durations...

duration for most flows are all 4294952.292 seconds. UPD, ICMP and TCP sesions... some flows have 0s duration, and a few look normal.

In addition there a no tcp flags on the "weird" TCP sessions.

I'm exporting netflow version 5 dumped to nfdump. Netflow from a couple of other routers look ok, so i'm guessing it's not the collector...

using sw version 12.2(37)SG1

anyone have any ideas?

4 Replies 4

Jan Nejman
Level 3
Level 3

Hello,

it could be a problem with collector. You can use our public collector to test it if it is acceptable for you. Please, let me know on my email, and we can try some debugs...

Kind regards

Jan Nejman

nejman (at) caligare (dot) com

Caligare, Co.

http://www.caligare.com/

thx for the tip, but it's not the collector.

i dumped the packets from my two routers with tcpdump and had a look at the in wireshark, which has a cflow decoder

On the router that works, a sample packet has a start time of:

ba:dd:cf:78 - 3135098.744s

end:

ba:dd:cf:88 - 3135098.760s

on the cat4500, it's travelling in time:

start:

97:8b:24:4c - 2542478.412s

end

97:8a:e9:b4 - 2542463.412s

it's ending before it's starting.

I have tried turning netflow off and on again on the router, no luck... next step restarting the router or upgrading ios i suppose...

regards

axel

Oops, it's not good. I solved similar problem, but corrupted time was only from two line-cards. Try enable ntp with option update-calendar. Maybe it helps.

It is a very interesting bug, please, could you send me result if reboot or IOS upgrade helps? I'm personally interest in the right solution.

Kind regards,

Jan

I upgraded the ios to the latest version and restarted the box. This seems to have fixed the problem.

thx for your help

regards

axel

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: