Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Netflow showing src IP address Is it a bug...


Our netflow shows some funny entries, and these packets (with source IP are not observed by sniffer trace.

Is it a switch bug?

sw1#show ip flow top-talkers

SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Bytes

Vl112 Null 60 0000 0000 22K

Vl112 Null 35 0000 0000 6468

2 of 10 top talkers shown. 2 flows processed.

Cisco Employee

Re: Netflow showing src IP address Is it a bug...

You might also notice that DstIf is Null

Output interfaces are "Null" in the following cases:

1. The packets are blocked by an ACL

2. The packets are process switcheded. This could be because the feature is not supported

by CEF or fast switching. Do a "show int stats" to distinguish between data being process switched instead of cef/fast switched. Also, check "show cef interface" and "show ip interface" to check if CEF is disabled or packets are being punted/dropped due to an unsupported feature configured.

3. Multicast traffic

4. Packets destined for the router

5. Tunnels (IPIP, GRE, IPSEC, L2TP) & WCCP

6. Static route to null0 - e.g. ip route Null0

7. Dropped by QoS

CreatePlease login to create content