You're of course right, because if it didn't I never would've known this was happening =)
The problem now is getting my upstream to figure out what the source is =( -Drew -----Original Message----- From: Gert Doering [mailto:[email protected]] Sent: Thursday, February 25, 2010 4:37 PM To: Drew Weaver Cc: Cisco-nsp Subject: Re: [c-nsp] Netflow - GSR engine 5 Hi, On Thu, Feb 25, 2010 at 11:43:37AM -0500, Drew Weaver wrote: > Should ingress packets dropped by ACLs still hit Netflow on the GSR with E5 > linecards? > > Gi2/0/2 10.1.123.32 Null 10.1.123.3 11 A29F 0035 1 I'm not sure whether this is documented anywhere, but this is expected, and it is actually recommended to use "Netflow dest if=null" instead of "ACL logging" to see which packets your network is refusing. > So basically a packet is being sent in from the Internet sourced from > one of my own IP addresses, and I assume it is being dropped because > of the ACL on our Internet connections that says we don't want traffic > coming in from ourselves, but why is it showing up in the netflow > exports? So that you can keep track of what you're dropping. You might want to know about it :-) gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany [email protected] fax: +49-89-35655025 [email protected] _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
