Hi Here is some updates. The config works ! Netflow does report it as a dropped packet I had leakage of Net10 input from another source that was tainting my sniffer port. I've corrected.
I've seen no other damage to my network since turning this on over the past 24 hours. Here is a reference config: interface TenGigabitEthernet4/1 description Transit: UPSTREAM [10Gig] ip address 216.XXX.YYY.ZZZ 255.255.255.252 ip verify unicast source reachable-via any ip flow ingress ip flow egress load-interval 30 ipv6 address 2001:XXX:1:YYY::2/126 mls netflow sampling end ip route 10.0.0.0 255.0.0.0 Null0 I am working on a more extensive deployment and will try to write it up and post it back for others. Again, many thanks to the various folks that responded, both on and off list. Make it a great day On Mon, Feb 9, 2015 at 2:48 AM, Nick Hilliard <[email protected]> wrote: > On 09/02/2015 04:39, John Brown wrote: >> shouldn't that cause net-10 into the FIB with a ptr to null0 and thus >> uRPF will discard ?? >> >> Netflow still shows traffic on that interface with source's in Net-10. > > yes, correct. Assuming you don't have any more-specifics in the 10/8 > range, the packet will be discarded but will be accounted for by netflow. > If you check the destination interface of this prefix in the netflow > record, you should see that it's being dumped. > > 80mbit/sec of dud traffic like this is annoying. Do you have an account > manager that you can shout at? > > Nick > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
