On 12/12/05, Alex Shepard <[EMAIL PROTECTED]> wrote: > Is your router still exporting flows? > > rtr> show ip flow export > and > rtr> show ip cache flow
Yep. In fact, tcpdump shows the packets arriving on the flow-capture box. MCAD-Gtwy#sh ip flow export Flow export v5 is enabled for main cache Exporting flows to 150.253.10.35 (9800) Exporting using source interface FastEthernet2/0 Version 5 flow records 125541799 flows exported in 4184727 udp datagrams 0 flows failed due to lack of export packet 1 export packets were sent up to process level 0 export packets were dropped due to no fib 0 export packets were dropped due to adjacency issues 0 export packets were dropped due to fragmentation failures 0 export packets were dropped due to encapsulation fixup failures MCAD-Gtwy#sh ip cache flow <snip> IP Flow Switching Cache, 278544 bytes 2020 active, 2076 inactive, 125545168 added 2061611580 ager polls, 0 flow alloc failures Active flows timeout in 5 minutes Inactive flows timeout in 15 seconds last clearing of statistics never cliff ~ # tcpdump -i eth0 -n port 9800 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 68 bytes 17:30:43.337221 IP 10.0.10.1.49490 > 150.253.10.35.9800: UDP, length: 1464 17:30:43.337308 IP 10.0.10.1.49490 > 150.253.10.35.9800: UDP, length: 1464 17:30:43.338331 IP 10.0.10.1.49490 > 150.253.10.35.9800: UDP, length: 1464 17:30:43.338453 IP 10.0.10.1.49490 > 150.253.10.35.9800: UDP, length: 1464 17:30:43.340104 IP 10.0.10.1.49490 > 150.253.10.35.9800: UDP, length: 1464 17:30:43.340227 IP 10.0.10.1.49490 > 150.253.10.35.9800: UDP, length: 1464 17:30:44.340343 IP 10.0.10.1.49490 > 150.253.10.35.9800: UDP, length: 1464 17:30:44.341389 IP 10.0.10.1.49490 > 150.253.10.35.9800: UDP, length: 1464 <snip> _______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
