cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1121
Views
3
Helpful
2
Replies

What is the meaning of "reason x" in "debug ip flow export" output?

taoleiccie
Level 1
Level 1

Hello.

I issue the command "debug ip flow export", and get this output

===============================================

Oct 31 17:36:39.355: IPFLOW: Sending UDP export pak 14 to 192.168.1.2

port 6000 reason 4

===============================================

What does "reason 4" mean, please?

Where can I find definition about the meaning of these "reason"

numbers?

Thank you.

2 Replies 2

David Stanford
Cisco Employee
Cisco Employee

0: FLOW_EXPORT_FORCED, Packet export triggered by CLI action (export

version has changed so send the pak belonging to the old version and put

any data for the new version in a new pak.)

1: FLOW_EXPORT_RECORD_FULL_BEFORE, Packet is full before filling data

(we have data to add but we need to send the existing pak as the data

doesn't fit.)

2: FLOW_EXPORT_RECORD_FULL_AFTER, Record is full after filling data (we

have added data to the pak and it is now full so send it)

3 :FLOW_EXPORT_RECORD_FULL_V9, Record is full during v9 tpl export (we

are resending templates and the pak does not have room for the next v9

template so send it and start a new pak).

4 :FLOW_EXPORT_RECORD_OLD Record is too old (send if it has been around

for more than 10s)

Hello, davistan.

I just make an experiment. I leave the active/inactive timeout as default, that is 30 min for active timout and 15 sec for inactive.

First I make a flow using ping, after that, there is no other flow on the subnet, and wait the first flow to expire.

After the first flow expire, I notice that every 26 or 27 sec, a "reason 4" packet is sent out. Besides, this interval rises as the inactive timeout rises. In other words, it is "inactive timeout value" plus 11 or 12 sec. e.g If I set inactive timeout to 30, then every 42 sec, a "reason 4" packet is sent out.

That's strange.