Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

understand netflow info

hi,

I enabled netflow on some of my ISR G1/2 routers but on some of them I don't understand output.

In dest interface row, more often I can see : gi0/1, tunnelX.. but sometimes, I see "null0" and "Local".

What I understand is that null0 is because I have some static route to null, so OK.

About "Local", I can understand to see it when dest is inside interface (I have only Gi0/0, Gi0/1 and tunnelX interfaces), but in my case more often when I see "Local" it's not the inside IP... why ? is it a bug ? any idea ? packet on network IP or broadcast IP ?

example : router with Gi0/1 = 172.30.160.251

and what I see with netflow :

172.30.160.91:8080 (Gi0/1)=> 192.168.108.219:51720 (Local)1.64 Mo  | TCP        => why Local ???

172.30.160.102:631 (Gi0/1)=> 172.30.160.255:631 (Local)196.51 Ko  | UDP         => why Local ???

172.30.160.91:8080 (Gi0/1)=> 192.168.108.219:53856 (Local)4.73 Ko  | TCP        => why Local ???

172.31.1.241:33256 (Gi0/1)=> 172.30.160.251:161 (Local)1.8 Ko  | UDP               => here seems normal

172.31.1.241:34378 (Gi0/1)=> 172.30.160.251:161 (Local)1.78 Ko  | UDP             => here seems normal

IOS on routers : 15.1(4)M7 3825

could it be an issue with netflow when there are ACL to log all traffic ? because on most of my routers, it's ok, only few have problem, so I try to undertand.

Thanks

Nicolas

122
Views
0
Helpful
0
Replies