NetFlow in Cisco NCS 540

[johnlloyd_13]

hi,

i've applied this netflow config in our NCS 540 IOS-XR router which is an MPLS P router.

i checked in our netflow analyzer there's only 2-way/point-to-point traffic/OSPF between this router and another P router also an NCS 540 via the G0/0/0/19 link.

is there an additional command missing to "drill down" the MPLS traffic to see other top talker/IP address?

is sFlow should be configured instead?

flow exporter-map EXPORTER
destination 10.1.1.10
transport udp 2055
source Loopback0
version v9
template data timeout 60
template options timeout 60
options interface-table
options sampler-table

sampler-map SAMPLER
random 1 out-of 500

flow monitor-map MONITOR
record ipv4
exporter EXPORTER
cache entries 1000000
cache timeout active 60
cache timeout inactive 30
cache timeout rate-limit 2000

interface GigabitEthernet0/0/0/19
 flow ipv4 monitor MONITOR sampler SAMPLER ingress

[Giuseppe Larosa]

Hello @johnlloyd_13 ,

>> i've applied this netflow config in our NCS 540 IOS-XR router which is an MPLS P router.

>>flow monitor-map MONITOR
>> record ipv4

if the router is a P node all user traffic travels inside MPLS. You should try to define the flow record to check and collect the MPLS fields.

I don't know if this platform can inspect inside MPLS packets

Hope t help

Giuseppe