Prime Infrastructure - Netflow Top N Application Unknown - Custom Services

[PatrickOS]

Hi,

I have configured my Prime Infrastructure 3.1 as a Netflow receiver and I can see flows from routers in the Performance overview. In the TOP N Application I see a lot of unknown traffic. I have figured out the details of the unknown traffic (with https://supportforums.cisco.com/t5/network-management/how-to-find-application-or-ports-of-unknow-traffic/td-p/2996001) and added custom Services but the I still see a lot of unknown traffic. I have read somewhere that I have do deploy the custom Services also to the devices to have a consistent view. But is this needed to show the custom Services also in Prime? My understanding of this: Router send Netflow data to prime without user-friendly names, just IPs and Ports and other numbers. Prime save this data into a database and during the view it translate IPs and Ports and other numbers to user friendly names. Am I right?

Thanks,

Patrick

[PatrickOS · Accepted solution]

I kept searching and found the Bug CSCuw33721. It describe the behavior for Prime 2.2 that only unclassified traffic from the netflow sender will be classify. I checked the netflow sender configuration and it marked a lot of traffic with Application ID of unknown. We change the configuration on the router to not export the Application ID and then Prime classify all traffic with the configured Application & Services in Prime.