04-11-2008 06:47 AM
Hi
I've got netflow set up on a catalyst 4500 with a supervisor V-10GE. It's dumping data to my collector but the flows look very weird, most of the flows have very high durations...
duration for most flows are all 4294952.292 seconds. UPD, ICMP and TCP sesions... some flows have 0s duration, and a few look normal.
In addition there a no tcp flags on the "weird" TCP sessions.
I'm exporting netflow version 5 dumped to nfdump. Netflow from a couple of other routers look ok, so i'm guessing it's not the collector...
using sw version 12.2(37)SG1
anyone have any ideas?
04-14-2008 01:38 AM
Hello,
it could be a problem with collector. You can use our public collector to test it if it is acceptable for you. Please, let me know on my email, and we can try some debugs...
Kind regards
Jan Nejman
nejman (at) caligare (dot) com
Caligare, Co.
04-14-2008 11:13 PM
thx for the tip, but it's not the collector.
i dumped the packets from my two routers with tcpdump and had a look at the in wireshark, which has a cflow decoder
On the router that works, a sample packet has a start time of:
ba:dd:cf:78 - 3135098.744s
end:
ba:dd:cf:88 - 3135098.760s
on the cat4500, it's travelling in time:
start:
97:8b:24:4c - 2542478.412s
end
97:8a:e9:b4 - 2542463.412s
it's ending before it's starting.
I have tried turning netflow off and on again on the router, no luck... next step restarting the router or upgrading ios i suppose...
regards
axel
04-15-2008 01:11 AM
Oops, it's not good. I solved similar problem, but corrupted time was only from two line-cards. Try enable ntp with option update-calendar. Maybe it helps.
It is a very interesting bug, please, could you send me result if reboot or IOS upgrade helps? I'm personally interest in the right solution.
Kind regards,
Jan
04-28-2008 02:24 AM
I upgraded the ios to the latest version and restarted the box. This seems to have fixed the problem.
thx for your help
regards
axel
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: