Netflow showing src IP address 3.0.199.0? Is it a bug...

[zhichao]

Hi

Our netflow shows some funny entries, and these packets (with source IP 3.0.199.0) are not observed by sniffer trace.

Is it a switch bug?

sw1#show ip flow top-talkers

SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Bytes

Vl112 3.0.199.0 Null 0.238.0.21 60 0000 0000 22K

Vl112 3.0.199.0 Null 0.238.0.22 35 0000 0000 6468

2 of 10 top talkers shown. 2 flows processed.

[David Stanford]

You might also notice that DstIf is Null

Output interfaces are "Null" in the following cases:

1. The packets are blocked by an ACL

2. The packets are process switcheded. This could be because the feature is not supported

by CEF or fast switching. Do a "show int stats" to distinguish between data being process switched instead of cef/fast switched. Also, check "show cef interface" and "show ip interface" to check if CEF is disabled or packets are being punted/dropped due to an unsupported feature configured.

3. Multicast traffic

4. Packets destined for the router

5. Tunnels (IPIP, GRE, IPSEC, L2TP) & WCCP

6. Static route to null0 - e.g. ip route 146.149.0.0 255.255.0.0 Null0

7. Dropped by QoS