cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1231
Views
0
Helpful
2
Replies

Netflow vs NDE

hank
Level 1
Level 1

I am wondering if I am double counting flows. Here is my config snippet

from a 7613 running 12.2(18)SXE4:

mls flow ip interface-full

mls nde sender version 5

!

ip flow-export source Loopback0

ip flow-export version 5 origin-as

ip flow-export destination XXX.139.197.76 9800

Most interfaces look like this:

interface Serial1/0/5

ip route-cache flow

But looking at:

gp1#sho ip flow export

Flow export v5 is enabled for main cache

Exporting flows to xxx.139.197.76 (9800)

Exporting using source interface Loopback0

Version 5 flow records, origin-as

460190792 flows exported in 15339766 udp datagrams

0 flows failed due to lack of export packet

3 export packets were sent up to process level

0 export packets were dropped due to no fib

199 export packets were dropped due to adjacency issues

0 export packets were dropped due to fragmentation failures

0 export packets were dropped due to encapsulation fixup failures

0 export packets were dropped enqueuing for the RP

0 export packets were dropped due to IPC rate limiting

gp1#sho mls nde

Netflow Data Export enabled

Exporting flows to xxx.139.197.76 (9800)

Exporting flows from xxx.139.220.90 (58540)

Version: 5

Layer2 flow creation is disabled

Layer2 flow export is disabled

Include Filter not configured

Exclude Filter not configured

Total Netflow Data Export Packets are:

1018492393 packets, 0 no packets, 3766475592 records

Can I be doubling exported flows? How can I tell? How can I make

it just export a flow once?

Thanks,

Hank

2 Replies 2

a-vazquez
Level 6
Level 6

Also issue the command "ip flow-export ingress" under the interface configuration.

Jan Nejman
Level 3
Level 3

Hello,

why do you think that flows are send more times?

Number of MLS flows is almost higher than number of flows processed by routing card (only first packet go through routing process [this packets are sent in via ip flow export command], rest of flow is switched throught MLS [exported via mls commands].

Jan