On Dec 22, "[EMAIL PROTECTED]" wrote: > I (still) have problems on my Cisco 7600 in Native mode (SUP2 - MSFC2 - PFC > 2). Here is my config : > > mls aging long 64 > mls aging normal 32 > mls flow ip interface-full > mls flow ipx destination > mls nde sender > mls nde interface > > ip flow-cache timeout active 1 > mls flow ip interface-full > ip flow-export source Loopback0 > ip flow-export version 5 > ip flow-export destination x.x.x.x 2055 > > and "ip route-cache flow" on 2 interfaces > > I'm receiving information on my collector, but those pieces of information > are different to some reliable information I have. (for example the > collector learn me 125MB of conversation where there was 190MB actually) > > Do you have any idea ?
Can you test for small amounts of data? I found this method kind of cute: Write a script that creates pings of sizes that increase two-fold (making sure to account for ICMP and IP headers, I'm not sure if this is correct or not, but you get the idea: ping -s 56 TARGET_IP ping -s (56 + 64) TARGET_IP ping -s (56 + 64 + 128) TARGET_IP ping -s (56 + 64 + 128 + 256) TARGET_IP Choose several target IPs and see if the size of the flows is what you expect. If it's not, you can even tell exactly which packets are missing :) (Like perhaps the first packet if you're having cached vs. non-cached problem.) If they all go through to all the targets you can think of, then you're probably having a load problem: Either the router is dropping flows or they're being dropped on the collector. I think there's some flow-stat you can look at to see if they're being dropped by the router, plus check for interface errors on your collector. Good luck! Mike _______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
