-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Michael,
Really difficult to tell! I'm really not a CISCO expert and boxes behavior. I
would need some pcap collected export
packet from the router to see, what really was sent by your routers.
- Peter
Michael Pacheco wrote:
> Hi All,
>
> Ever see a problem like this?
>
> 2 Cisco 6509 L3 boxes with exact same SUP and PFC cards and IOS version,
> netflow export is configured exactly the same as well
>
> Both in separate channels to nfsen (BTW - before I forget - Peter, Thank you
> - great product!) ...
>
> One Cisco box outputs netflow as expected, the other one output flows only
> with 0:0:0 in the proto:src port:dst port fields so I have great graphs and
> profiles from one channel and the other channel from my misbehaving Cisco box
> have all the flows lumped into "other".
>
> This is not an nfsen problem, its a Cisco problem, just asking the list if
> anyone has seen this before ...
>
> Good box output:
>
> GOOD_BOX_1#sh mls netflow ip destination xxx.xxx.6.32
> Displaying Netflow entries in Supervisor Earl
> DstIP SrcIP Prot:SrcPort:DstPort Src i/f :AdjPtr
> -----------------------------------------------------------------------------
> Pkts Bytes Age LastSeen Attributes
> ---------------------------------------------------
> xxx.xxx.6.32 xxx.xxx.20.196 icmp:8 :0 Vl20
> :0x0
> 1 60 201 10:16:06 L3 - Dynamic
> xxx.xxx.6.32 xxx.xxx.0.1 tcp :31596 :5550 Vl1
> :0x0
> 66 19427 16 10:19:25 L3 - Dynamic
>
>
> BAD_BOX_1#sh mls netflow ip destination xxx.xxx.6.32
> Displaying Netflow entries in Supervisor Earl
> DstIP SrcIP Prot:SrcPort:DstPort Src i/f :AdjPtr
> -----------------------------------------------------------------------------
> Pkts Bytes Age LastSeen Attributes
> ---------------------------------------------------
> xxx.xxx.6.32 xxx.xxx.6.36 0 :0 :0 -- :0x0
> 22 1507 103 10:22:11 L2 - Dynamic
> xxx.xxx.6.32 xxx.xxx.30.132 0 :0 :0 --
> :0x0
> 10 1574 242 10:18:12 L3 - Dynamic
>
> Interesting problem .. suspect right now - excessive packet fragmentation at
> one site ... will let the list know if I find anything, but if anyone has
> ever seen this before please let me know.
>
> Thanks, Mike
>
>
>
>
>
>
> CONFIDENTIALITY NOTICE:
> This e-mail and any files transmitted with it are confidential and may
> contain health information protected by law. Any unauthorized use or
> disclosure is strictly prohibited. If you are not the intended recipient,
> please notify the sender by return email, delete this email, and destroy any
> copies. Please note that any views or opinions presented in this e-mail are
> solely those of the author and do not necessarily represent those of
> Southcoast. The recipient should check this e-mail and any attachments for
> the presence of viruses. Southcoast accepts no liability for any damage
> caused by any virus transmitted by this e-mail.
>
>
>
>
>
> ------------------------------------------------------------------------------
> Create and Deploy Rich Internet Apps outside the browser with Adobe(R)AIR(TM)
> software. With Adobe AIR, Ajax developers can use existing skills and code to
> build responsive, highly engaging applications that combine the power of local
> resources and data with the reach of the web. Download the Adobe AIR SDK and
> Ajax docs to start building applications today-http://p.sf.net/sfu/adobe-com
> _______________________________________________
> Nfsen-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [email protected] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
iQCVAwUBSYviov5AbZRALNr/AQJOHAP9EB3rNH3IT2G3nnCE4PibX/L5qZ4gyUx8
7cFEDo9rz2wOIlFjRFL6ykyOiZ6Op68O+OPpwq8Jvw3TuKn8DDx0aCns2lqs9Vcg
DfL4DUzjxM+BMXhpJ622G8BdEe/HEwYmjmJjr34pEjGHYCMqqxRJMv/VOst3qOUg
/gqFVRZ7KEQ=
=oh+C
-----END PGP SIGNATURE-----
------------------------------------------------------------------------------
Create and Deploy Rich Internet Apps outside the browser with Adobe(R)AIR(TM)
software. With Adobe AIR, Ajax developers can use existing skills and code to
build responsive, highly engaging applications that combine the power of local
resources and data with the reach of the web. Download the Adobe AIR SDK and
Ajax docs to start building applications today-http://p.sf.net/sfu/adobe-com
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
