Hi guys, having trouble generating NetFlow data using SPAN traffic. I have a 2960 switch and 1841 router. The router is running NetFlow. The switch is running SPAN with a session destination of f0/1, which the router is connected to.
The idea is to have NetFlow generate export packets based on this mirrored traffic and send it out through the same port to get to the Internet through another switch (although now that I think about it this is possibly the issue). The collector is in a different network. Everything is in VLAN 1. The SPAN source port is just connected to a regular Windows host to test with. However, the collector isn't getting anything from this. Have verified locally on the router with show ip cache flow and it's not displaying statistics it should e.g. no TCP/web if I use the host to go to a website.
I have posted parts of the relevant config (some of the commands I did manually off memory, forgot to bring home backup configs and I can't access them right now). I'm sure it's something simple that I'm missing. I have noticed that the packet count in the output of the switch SPAN destination port vs the input of the router ingress port is vastly different (using "sh int").
I have also noticed that the router connection doesn't appear in the switch's MAC address table although I assume this is to do with the port being a monitor port e.g. line protocol is naturally down. L1-3 connectivity has already been verified e.g. from 1841 f0/0 to collector or 1841 f0/0 to 2960 SVI). I have tried v5 and v9 of NetFlow and ip flow ingress vs egress and different SPAN destination commands e.g no ingress, replicate.
2960:
interface FastEthernet0/1
switchport mode access
no logging event link-status
no snmp trap link-status
!
monitor session 1 source interface fastethernet0/2 both
monitor session 1 destination interface fastethernet0/1 ingress untagged vlan 1
1841:
interface FastEthernet0/0
description To 2960 f0/1
ip address iphere 255.255.255.0
ip flow ingress
ip flow egress
duplex auto
speed auto
!
ip flow-export version 9
ip flow-export destination iphere 2055
Thanks for any assistance with this issue.
