Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Netflow showing src IP address 3.0.199.0? Is it a bug...

Hi

Our netflow shows some funny entries, and these packets (with source IP 3.0.199.0) are not observed by sniffer trace.

Is it a switch bug?

sw1#show ip flow top-talkers

SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Bytes

Vl112 3.0.199.0 Null 0.238.0.21 60 0000 0000 22K

Vl112 3.0.199.0 Null 0.238.0.22 35 0000 0000 6468

2 of 10 top talkers shown. 2 flows processed.

1 REPLY
Cisco Employee

Re: Netflow showing src IP address 3.0.199.0? Is it a bug...

You might also notice that DstIf is Null

Output interfaces are "Null" in the following cases:

1. The packets are blocked by an ACL

2. The packets are process switcheded. This could be because the feature is not supported

by CEF or fast switching. Do a "show int stats" to distinguish between data being process switched instead of cef/fast switched. Also, check "show cef interface" and "show ip interface" to check if CEF is disabled or packets are being punted/dropped due to an unsupported feature configured.

3. Multicast traffic

4. Packets destined for the router

5. Tunnels (IPIP, GRE, IPSEC, L2TP) & WCCP

6. Static route to null0 - e.g. ip route 146.149.0.0 255.255.0.0 Null0

7. Dropped by QoS

267
Views
5
Helpful
1
Replies
CreatePlease login to create content