cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1415
Views
0
Helpful
3
Replies

Help setting up NetFlow

ROBERT ISAACS
Level 1
Level 1

Hello,

I am trying to set up NetFlow on a 2851 router running version 12.4 (8a). I keep getting a message saying top talkers is not set up. Here are the commands that I have entered

config t

ip cef

int ser0/0/0:0

ip flow ingress (I have also tried

ip route-cache flow

exit

ip flow-top-talkers

top 10

and then I tried

show ip flow-top-talkers.

I am pretty green as far as Cisco IOS is concerned but I got these commands from Cisco literature and still no cigar.

Thanks in advance for any help. I am in a very rural area and don't have anyone else to talk to.

1 Accepted Solution

Accepted Solutions

Edison Ortiz
Hall of Fame
Hall of Fame

According to:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios124/124cr/hnf_r/nfl_a1h.htm#wp1314306

NetFlow top talkers also requires that you configure the sort-by and top commands.

You have the top configured, please enter the sort-by as well.

HTH,

View solution in original post

3 Replies 3

Edison Ortiz
Hall of Fame
Hall of Fame

According to:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios124/124cr/hnf_r/nfl_a1h.htm#wp1314306

NetFlow top talkers also requires that you configure the sort-by and top commands.

You have the top configured, please enter the sort-by as well.

HTH,

Edison,

Thanks this resolved my issue. It was not on the Cisco Tech overview example that I was using to configure. I appreciate you help and hope you have a good day.

BTW, the main reason for that is so a single top talkers table can be set up for the MIB and all users.

Else you might have one user on the console wanting the top 10 sorted one way, another user on a network port wanting the top 20 sorted another way, and a MIB user wanting the top 50 sorted some other way - so there'd be oodles of netflow data to store, over and above the netflow cache!

Setting the sort order and number of top flows to be shown means all queries can be satisfied out of a single results table - which is maintained for a short time to allow per-line MIB polling.

Review Cisco Networking for a $25 gift card