6506 - NetFlow Figures too Low

[ezuser666]

Morning,

On Friday I can configured one of my customers 6506s to export NetFlow to Scrutinizer however coming in this morning it has barely reported a peak over 7Kbps of traffic whereas on our bandwidth monitoring system the interface ha shown over 1Gbps. I used the below link as a guide:

http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/70974-netflow-catalyst6500.html

The 6506-E has a WS-SUP720-3BXL and is running s72033-adventerprisek9_wan-mz.122-33.SXI9.bin.

We are trying to monitor a couple of interface that are setup as an etherchannel using a WS-X6748-GE-TX line card. The interface we are exporting to is on the same line card.

Is it possible that not all the traffic is being seen by NetFlow as the line card is handling the processing instead?

Configuration in use is below:

mls netflow interface
mls flow ip interface-destination-source
!
interface Port-channelX
  ip address x.x.x.x x.x.x.x
  no ip redirects
  no ip unreachables
  ip flow ingress
  ip flow egress
  mls qos trust dscp
!
ip flow-top-talkers
  top 30
  sort-by bytes
  cache-timeout 5
!
ip flow-export source VlanX
ip flow-export destination x.x.x.x 2055
ip flow-top-talkers
top 30
sort-by bytes
cache-timeout 5

Thanks for any advise anyone can offer

Liam

[Philip D'Ath]

Try adding:

interface Port-channelX
  ip route-cache flow

[ezuser666]

Thanks for the reply. That was the initial command entered but the 6506 rewrote it to 'ip flow egress'.

[hmc250000]

I have the same problem with scrutinizer not showing the graphs as expected. I compared it to my ISP utilization graphs but the scrutinizer peaks are way lower. I wonder if it's an issue with scrutinizer showing much larger sample sizes in the graphs.