show ip cache flow - Bizarre output?

[Esteban Talavera]

Hi

I have a Cisco 881 router

when enter show ip cache flow, I see this:

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts

.

.

Fa4           M.M.M.M   Local         X.X.X.X 32 D090 FC43    13K

.

.

Is a large amount of packets.

The Interface F4 does not have big traffic

MTU 1500 bytes, BW 2048 Kbit/sec, DLY 100 usec,

     reliability 255/255, txload 3/255, rxload 49/255

I have a DMVPN Tunnel between M.M.M.M and X.X.X.X

I enter the same command in the remote peer and I don't get the traffic shown in the 881.

What this traffic means?

Thanks

[Richard Burts · Accepted solution]

In looking at your output the PR (protocol) is 32 which is in hex. Translated into decimal it is protocol 50, which is ESP. So you are probably seeing your DMVPN traffic. If the remote peer is not reporting this then I would assume that there is some difference in how NetFlow is configured on that device.

HTH

Rick

[shine pothen · Accepted solution]

adding to what Richard said.

check whether these commands are  on other device interface

ip flow ingress

ip flow engress

if these commands are not there then please enter it and then use the show command

sh ip cache flow.

sh ip cache verbose flow (details understanding of traffic)

Potha