cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
664
Views
0
Helpful
3
Replies

6506 - NetFlow Figures too Low

ezuser666
Level 1
Level 1

Morning,

On Friday I can configured one of my customers 6506s to export NetFlow to Scrutinizer however coming in this morning it has barely reported a peak over 7Kbps of traffic whereas on our bandwidth monitoring system the interface ha shown over 1Gbps. I used the below link as a guide:

http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/70974-netflow-catalyst6500.html

The 6506-E has a WS-SUP720-3BXL and is running s72033-adventerprisek9_wan-mz.122-33.SXI9.bin.

We are trying to monitor a couple of interface that are setup as an etherchannel using a WS-X6748-GE-TX line card. The interface we are exporting to is on the same line card.

Is it possible that not all the traffic is being seen by NetFlow as the line card is handling the processing instead?

Configuration in use is below:

mls netflow interface
mls flow ip interface-destination-source
!
interface Port-channelX
  ip address x.x.x.x x.x.x.x
  no ip redirects
  no ip unreachables
  ip flow ingress
  ip flow egress
  mls qos trust dscp
!
ip flow-top-talkers
  top 30
  sort-by bytes
  cache-timeout 5
!
ip flow-export source VlanX
ip flow-export destination x.x.x.x 2055
ip flow-top-talkers
top 30
sort-by bytes
cache-timeout 5

Thanks for any advise anyone can offer

Liam

3 Replies 3

Philip D'Ath
VIP Alumni
VIP Alumni

Try adding:

interface Port-channelX
  ip route-cache flow

Thanks for the reply. That was the initial command entered but the 6506 rewrote it to 'ip flow egress'.

I have the same problem with scrutinizer not showing the graphs as expected. I compared it to my ISP utilization graphs but the scrutinizer peaks are way lower. I wonder if it's an issue with scrutinizer showing much larger sample sizes in the graphs.

Review Cisco Networking for a $25 gift card