Justin Shore wrote: > Jeff Kell wrote: >> Justin Shore wrote: >>> Personally I'm still using ACLs on my border routers. At this point >>> in time I want the ACE hit counters for those rogue packets >> Hrmmm... will these show up in netflow in some identifiable fashion? > > That's a good question. I'm not sure if NF will get the chance to log > the flows before the ACL drops them. I'll check my flow dumps to see if > I can figure that out.
It depends on the platform, but on 6500s at least I know you get an output interface of 0. Sadly you get an output interface of 0 for a whole lot of other stuff, including glean failures (i.e. couldn't arp for the next hop), RPF failures and also traffic to the box e.g. SSH sessions. On that topic: It's very annoying that you can only get RPF counter failures out of 6500s via the CLI which is of course rubbish for automated monitoring. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
