You need to enable Cisco "mls nde sender version 5" command.
ip flow-export version 5 origin-as ip flow-export destination X.X.X.X 9985 ip flow-export destination X.X.X.X 9997 ip flow-aggregation cache as Francisco Lopez | Engineering MX: +52 (656) 257 - 1106 | US: +1 (915) 217 - 2235 -----Original Message----- From: Eric Doutreleau [mailto:eric.doutrel...@it-sudparis.eu] Sent: Thursday, May 26, 2011 11:07 AM To: nfsen-discuss@lists.sourceforge.net Subject: [Nfsen-discuss] nfcapd is logging no data i have run nfsen since one hour and nfcapd is logging no data the file nfcapd.xxxxxxx are only 276 bytes and when i run the command nfdump -r nfcapd.201105261845 Date flow start Duration Proto Src IP Addr:Port Dst IP Addr:Port Packets Bytes Flows i got nfcapd launch through nfsen and here is the command line /usr/local/bin/nfcapd -w -D -p 9995 -u apache -g apache -B 200000 -S 1 -P /var/lib/nfsen/var/run/p9995.pid -z -I REVE -l /var/lib/nfsen/profiles-data/live/REVE when i tcpdump the interface i can see the flow on port 9995 udp on my routeur the command show ip flow export Flow export v5 is enabled for main cache Exporting flows to 157.159.21.230 (9995) Exporting using source IP address 157.159.8.1 Version 5 flow records 1154401 flows exported in 46608 udp datagrams 0 flows failed due to lack of export packet 0 export packets were sent up to process level 0 export packets were dropped due to no fib 0 export packets were dropped due to adjacency issues 0 export packets were dropped due to fragmentation failures 0 export packets were dropped due to encapsulation fixup failures in the syslog i have the following messages May 26 19:00:10 degastux nfcapd[17511]: Ident: 'REVE' Flows: 0, Packets: 0, Bytes: 0, Sequence Errors: 0, Bad Packets: 0 May 26 19:00:10 degastux nfcapd[17511]: Total ignored packets: 0 May 26 19:00:15 degastux nfsen[17513]: 0 channels/alerts to profile May 26 19:00:15 degastux nfsen[17513]: Update profile live in group . May 26 19:00:15 degastux nfsen[17513]: Error reading channel stat information. Missing key 'first' May 26 19:00:16 degastux nfsen[17513]: Run expire at Thu May 26 19:00:00 2011 May 26 19:00:16 degastux nfsen[17513]: End expire at Thu May 26 19:00:00 2011 I have the feeling that this problem is a classic problem but i don't really where i have made a mistake thanks in advance for any help ------------------------------------------------------------------------------ vRanger cuts backup time in half-while increasing security. With the market-leading solution for virtual backup and recovery, you get blazing-fast, flexible, and affordable data protection. Download your free trial now. http://p.sf.net/sfu/quest-d2dcopy1 _______________________________________________ Nfsen-discuss mailing list Nfsen-discuss@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfsen-discuss ------------------------------------------------------------------------------ vRanger cuts backup time in half-while increasing security. With the market-leading solution for virtual backup and recovery, you get blazing-fast, flexible, and affordable data protection. Download your free trial now. http://p.sf.net/sfu/quest-d2dcopy1 _______________________________________________ Nfsen-discuss mailing list Nfsen-discuss@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
