John,
Are you looking for anything specific in the output? I've put the
start of it here - it is reporting lower than it should be.
Thanks,
Max
#show ip cache flow
-------------------------------------------------------------------------------
MSFC:
IP packet size distribution (1244M total packets):
1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480
.003 .740 .155 .017 .002 .003 .001 .001 .000 .000 .000 .000 .060 .001 .000
512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
.002 .001 .002 .003 .000 .000 .000 .000 .000 .000 .000
IP Flow Switching Cache, 8913408 bytes
311 active, 130761 inactive, 642188841 added
1097190609 ager polls, 0 flow alloc failures
Active flows timeout in 5 minutes
Inactive flows timeout in 15 seconds
IP Sub Flow Cache, 541000 bytes
621 active, 32147 inactive, 1282860630 added, 642188841 added to flow
0 alloc failures, 241090 force free
1 chunk, 27 chunks added
last clearing of statistics never
Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)
-------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow
TCP-Telnet 381984 0.0 1 49 0.1 0.8 14.4
TCP-FTP 2915025 0.6 1 55 1.0 1.4 15.2
TCP-FTPD 7469 0.0 1 46 0.0 1.7 9.2
TCP-WWW 26102690 6.0 1 47 8.3 1.3 14.3
TCP-SMTP 16392723 3.8 6 57 25.8 1.4 15.5
TCP-X 520072 0.1 3 47 0.3 0.3 15.8
TCP-BGP 1742546 0.4 2 317 1.1 5.3 15.4
TCP-NNTP 2475 0.0 1 47 0.0 1.1 11.1
TCP-Frag 38056 0.0 1 49 0.0 0.0 10.7
TCP-other 263637868 61.3 1 50 106.5 2.1 15.1
UDP-DNS 69836807 16.2 2 70 46.2 4.4 15.8
UDP-NTP 881396 0.2 1 76 0.2 0.9 15.6
UDP-TFTP 796 0.0 2 126 0.0 3.4 15.7
UDP-Frag 2137 0.0 2 1140 0.0 0.2 15.5
UDP-other 125087508 29.1 1 217 51.0 0.7 15.7
ICMP 134601441 31.3 1 64 47.8 0.9 15.6
IGMP 5 0.0 1 1500 0.0 0.0 16.4
IPINIP 2 0.0 1 36 0.0 0.0 15.6
GRE 5 0.0 4 81 0.0 25.4 15.8
IP-other 37714 0.0 106 59 0.9 267.3 3.7
Total: 642188719 149.5 1 87 289.6 1.8 15.4
On 2/19/07, John Fraizer <[EMAIL PROTECTED]> wrote:
> First off, what do you see when you execute "sh ip cache flow" on the
> router(s) in question?
>
> Next, is it possible that by default, your IOS is sampling flows rather than
> giving you 1:1 flows? That's something that caught me off guard going from
> 75xx series to much larger routers like the 12408 and 76xx series.
>
>
> John Fraizer
> Sr. Network Engineer
> Network Operations Engineering
> NuVox Communications
> FCNSA #FCA2566
>
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Max Clark
> Sent: Monday, February 19, 2007 11:00 PM
> To: [email protected]
> Subject: [Nfsen-discuss] Missing Something Basic
>
> Hi all,
>
> I installed and configured nfsen quite some time ago on a FreeBSD box
> (nfsen-1.2.4.20060412) I haven't really had the time to look at it
> since and now that we have some significant traffic to analyze things
> are not looking right (to clarify the nfcapd process is running, the
> web interface works, rrds update, etc...). Before I go to far all ip
> flow/mls configuration is below (and I have added "ip route-cache
> flow" to all of our interfaces to transit networks):
>
> ip flow-cache entries 131072
> ip flow-cache timeout active 5
> mls rp ip
> mls ip multicast flow-stat-timer 9
> mls aging fast time 30 threshold 64
> mls aging long 900
> mls aging normal 32
> no mls netflow
> mls flow ip interface-full
> no mls flow ipv6
> mls nde sender version 5
> no mls acl tcam share-global
> mls cef error action freeze
>
> ip flow-export source Loopback0
> ip flow-export version 5 origin-as
> ip flow-export destination x.x.x.x 9995
>
> I'm convinced that something is configured wrong because almost 2 Gbit
> of IP Traffic equates to these sized files on the nfsen box (see
> below) and when I look at the Packets/s graph it is reporting in the
> hundreds when I know on interface is pushing over 200k.
>
> -rw-r--r-- 1 www www 343K Feb 20 03:05 nfcapd.200702200300
> -rw-r--r-- 1 www www 319K Feb 20 03:10 nfcapd.200702200305
> -rw-r--r-- 1 www www 326K Feb 20 03:15 nfcapd.200702200310
> -rw-r--r-- 1 www www 345K Feb 20 03:20 nfcapd.200702200315
>
> What should I be looking at to troubleshoot/fix this?
>
> Thanks in advance,
> Max
>
> p.s. I'm running 122-18.SXF3 on a Cisco 6509 w/ a Sup 720 3BXL
>
> Cisco Internetwork Operating System Software IOS (tm) s72033_rp
> Software (s72033_rp-ADVENTERPRISEK9_WAN-M), Version 12.2(18)SXF3,
> RELEASE SOFT)
>
> --
> Max Clark
> http://www.clarksys.com
>
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share your
> opinions on IT & business topics through brief surveys-and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Nfsen-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
>
>
--
Max Clark
http://www.clarksys.com
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
