04-18-2019 08:52 AM - edited 04-18-2019 11:39 AM
ISR4331 16.03.06 - updated a Netflow monitor record; inspecting packet captures the new record is not in use.
sho flow exporter templates det Flow Exporter Flow-to-collector: Client: Flow Monitor My-netflow Exporter Format: NetFlow Version 9 Template ID : 258 Source ID : 256 Record Size : 51 Template layout _________________________________________________________________________________________ | Field | Type | Offset | Size | ----------------------------------------------------------------------------------------- | ipv4 source address | 8 | 0 | 4 | | ipv4 destination address | 12 | 4 | 4 | | ip tos | 5 | 8 | 1 | | ip protocol | 4 | 9 | 1 | | transport source-port | 7 | 10 | 2 | | transport destination-port | 11 | 12 | 2 | | transport tcp flags | 6 | 14 | 1 | | routing source as | 16 | 15 | 2 | | ipv4 source mask | 9 | 17 | 1 | | interface input snmp | 10 | 18 | 4 | | routing destination as | 17 | 22 | 2 | | routing next-hop address ipv4 | 15 | 24 | 4 | | ipv4 destination mask | 13 | 28 | 1 | | interface output snmp | 14 | 29 | 4 | | flow direction | 61 | 33 | 1 | | flow sampler | 48 | 34 | 1 | | counter bytes | 1 | 35 | 4 | | counter packets | 2 | 39 | 4 | | timestamp sys-uptime first | 22 | 43 | 4 | | timestamp sys-uptime last | 21 | 47 | 4 | -----------------------------------------------------------------------------------------
Even though the flow exporter shows that "flow direction" is in the template, a physical packet capture doesn't show us that field in the template.
sho run | s flow flow record Test_Record match ipv4 tos match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port match interface input match flow sampler match flow direction collect routing source as collect routing destination as collect routing next-hop address ipv4 collect ipv4 source mask collect ipv4 destination mask collect transport tcp flags collect interface output collect counter bytes collect counter packets collect timestamp sys-uptime first collect timestamp sys-uptime last flow exporter Flow-to-collector destination 10.1.1.1 source Loopback0 transport udp 2055 flow monitor My-netflow exporter Flow-to-collector cache timeout active 60 record Test_Record ip flow monitor My-netflow input ip flow monitor My-netflow output
Any thoughts?
Edit: Doing testing found this when changing from "netflow-original" to "Test_Record":
Apr 18 13:32:57.695: %FMFP-3-OBJ_DWNLD_TO_DP_FAILED: SIP1: fman_fp_image: [FNF Object] type:MON_FDEF_BIND name:My-netflow-0-Test_Record-3766897112 fnf-id:2000002 real-id:2 info:mon-id:2000001 flow-id:2000002 download to DP failed
Interesting.... maybe a bug?
04-22-2019 06:45 AM
16.03.08 exhibits the same behavior; as does 16.06.05.
04-23-2019 01:03 AM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide