I've got an issue with SNMP and netflow tools. They are displaying different data for the same (sub)interfaces. I'll explain in detail...
I've got metroethernet link which connects root A (Cisco 7606, 12.2(18)SXF8) and root B (Cisco 2811, 12.3(11)TS). MPLS is configured on the link (behind root B there is no more MPLS). I'm attaching root configurations (I've ommited parts of config).
Root A - gi2/6.2144
Root B - fa0/1
I've configured SNMP and netflow on both devices. I'm using two SNMP tools (CA Spectrum and eHealth) and two netflow tools (CA NetQoS ReporterAnalyzer and Fluke Networks NetFlow Tracker) to collect the data.
SNMP tools show the same info for defined (sub)interface.
Netflow tools also show the same info for defined (sub)interface.
I'm attaching reports from one SNMP tool and one netflow tool for the same time period.
1. Looking at SNMP tool, it can be seen quite amount of that data in both in and out direction.
2. Looking at netflow tool, it can be seen quite amount of that data in out direction, while in direction shows small amount of data.
I'm aware that Cisco has difficulties with SNMP counters on subinterfaces. I'm also aware that MPLS netflow has its own difficulties.
Root B netflow configuration is quite simple as it has just 2 interfaces to configure netflow on (Fa0/0 and Fa0/1). So I would guess SNMP and netflow data should match, but they don't. When you look at SNMP tool reports for roots A and B, it can be seen that traffic volume is practically mirrored.
Do you have any similar situation or some advice that could help me figure this out?
Thanks in advance!
Here are some things to consider:
If any of the above help, please vote on my post.
Thank you and good luck.
I know netflow won't report on non IP traffic. There is MPLS configured on these interfaces.
There are few packets dropped when looking at 'sh ip flow export' output.
Active and inactive parameters are set.
There is minimal amount of missed flows at my netflow receiver for each of devices.
Netflow is enabled on all physical interfaces on both devices. And netflow is showing very small amount of traffic in inbound direction and almost SNMP similar amount of traffic in outbound direction.
One way to skin this cat might be to NOT enable netflow metering on the MPLS side interface in the 2811 and try INGRESS/EGRESS on the other side. You should be able to see all of the traffic on all interfaces.. You arejust moving your observation point away from that MPLS stuff. The 7606 might be a bit more difficult due to there being more interfaces to deal with.
Make sure you use v9 so that flow direction is exported. That should help your reporing solution de-duplicate data.
Let us know if this workaround helps!