Hi all, I installed and configured nfsen quite some time ago on a FreeBSD box (nfsen-1.2.4.20060412) I haven't really had the time to look at it since and now that we have some significant traffic to analyze things are not looking right (to clarify the nfcapd process is running, the web interface works, rrds update, etc...). Before I go to far all ip flow/mls configuration is below (and I have added "ip route-cache flow" to all of our interfaces to transit networks):
ip flow-cache entries 131072 ip flow-cache timeout active 5 mls rp ip mls ip multicast flow-stat-timer 9 mls aging fast time 30 threshold 64 mls aging long 900 mls aging normal 32 no mls netflow mls flow ip interface-full no mls flow ipv6 mls nde sender version 5 no mls acl tcam share-global mls cef error action freeze ip flow-export source Loopback0 ip flow-export version 5 origin-as ip flow-export destination x.x.x.x 9995 I'm convinced that something is configured wrong because almost 2 Gbit of IP Traffic equates to these sized files on the nfsen box (see below) and when I look at the Packets/s graph it is reporting in the hundreds when I know on interface is pushing over 200k. -rw-r--r-- 1 www www 343K Feb 20 03:05 nfcapd.200702200300 -rw-r--r-- 1 www www 319K Feb 20 03:10 nfcapd.200702200305 -rw-r--r-- 1 www www 326K Feb 20 03:15 nfcapd.200702200310 -rw-r--r-- 1 www www 345K Feb 20 03:20 nfcapd.200702200315 What should I be looking at to troubleshoot/fix this? Thanks in advance, Max p.s. I'm running 122-18.SXF3 on a Cisco 6509 w/ a Sup 720 3BXL Cisco Internetwork Operating System Software IOS (tm) s72033_rp Software (s72033_rp-ADVENTERPRISEK9_WAN-M), Version 12.2(18)SXF3, RELEASE SOFT) -- Max Clark http://www.clarksys.com ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
