ISR4331 16.03.06 - updated a Netflow monitor record; inspecting packet captures the new record is not in use.
sho flow exporter templates det
Flow Exporter Flow-to-collector:
Client: Flow Monitor My-netflow
Exporter Format: NetFlow Version 9
Template ID : 258
Source ID : 256
Record Size : 51
Template layout
_________________________________________________________________________________________
| Field | Type | Offset | Size |
-----------------------------------------------------------------------------------------
| ipv4 source address | 8 | 0 | 4 |
| ipv4 destination address | 12 | 4 | 4 |
| ip tos | 5 | 8 | 1 |
| ip protocol | 4 | 9 | 1 |
| transport source-port | 7 | 10 | 2 |
| transport destination-port | 11 | 12 | 2 |
| transport tcp flags | 6 | 14 | 1 |
| routing source as | 16 | 15 | 2 |
| ipv4 source mask | 9 | 17 | 1 |
| interface input snmp | 10 | 18 | 4 |
| routing destination as | 17 | 22 | 2 |
| routing next-hop address ipv4 | 15 | 24 | 4 |
| ipv4 destination mask | 13 | 28 | 1 |
| interface output snmp | 14 | 29 | 4 |
| flow direction | 61 | 33 | 1 |
| flow sampler | 48 | 34 | 1 |
| counter bytes | 1 | 35 | 4 |
| counter packets | 2 | 39 | 4 |
| timestamp sys-uptime first | 22 | 43 | 4 |
| timestamp sys-uptime last | 21 | 47 | 4 |
-----------------------------------------------------------------------------------------
Even though the flow exporter shows that "flow direction" is in the template, a physical packet capture doesn't show us that field in the template.
sho run | s flow
flow record Test_Record
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input
match flow sampler
match flow direction
collect routing source as
collect routing destination as
collect routing next-hop address ipv4
collect ipv4 source mask
collect ipv4 destination mask
collect transport tcp flags
collect interface output
collect counter bytes
collect counter packets
collect timestamp sys-uptime first
collect timestamp sys-uptime last
flow exporter Flow-to-collector
destination 10.1.1.1
source Loopback0
transport udp 2055
flow monitor My-netflow
exporter Flow-to-collector
cache timeout active 60
record Test_Record
ip flow monitor My-netflow input
ip flow monitor My-netflow output
Any thoughts?
Edit: Doing testing found this when changing from "netflow-original" to "Test_Record":
Apr 18 13:32:57.695: %FMFP-3-OBJ_DWNLD_TO_DP_FAILED: SIP1: fman_fp_image: [FNF Object] type:MON_FDEF_BIND name:My-netflow-0-Test_Record-3766897112 fnf-id:2000002 real-id:2 info:mon-id:2000001 flow-id:2000002 download to DP failed
Interesting.... maybe a bug?
