Hi,
On 05/29/2015 11:39 AM, Nikolaos Milas wrote:
> Hello,
>
> We are using nfsen 1.3.6p1 with nfdump 1.6.6 (on CentOS 5) with great
> success (thank you).
>
> We have just upgraded two Cisco 3825 routers from IOS version 12.4(9)T2
> to 12.4(24)T8 (Advanced Enterprise).
>
> Until now (with v12.4(9)T2), netflow was working fine in nfsen.
>
> With the new version we were seeing very strange behavior. Stats were
> not correct.
>
> I followed directions I found on the Internet and changed from standard
> (old-fashioned) netflow export to "Flexible Netflow" and now stats seem
> to be correct, EXCEPT Packet Stats.
>
> Packet Stats seem to be magnified by a very large factor, est. at
> 100,000 (100K). That is, when the real packet traffic is at 100
> packets/sec, the stats show it as 10M/s (approximate estimation)!
>
> Can you please help me in identifying the cause of this behavior and
> suggest a solution?
>
> I've tried my best until now, but I'm at a loss.
>
> I will send to Peter directly a zip file with a full (5 min) capture
> from our two routers, hoping it will help in tracing the problem.
>
> For reference here is the current config:
>
> flow exporter IPv6
> destination 195.251.xxx.xxx
> source Loopback0
> transport udp 9995
> !
> flow exporter IPv4
> destination 195.251.xxx.xxx
> source Loopback0
> !
> flow monitor IPv6
> record netflow ipv6 original-output
> exporter IPv6
> transport udp 9995
> !
> flow monitor IPv4
> record netflow ipv4 original-output
> exporter IPv4
> !
>
> And on each interface:
>
> ip flow monitor IPv4 input
> ipv6 flow monitor IPv6 input
>
> Thanks in advance,
> Nick
For me it looks like a "sampling rate" problem.
See nfcapd(1) for the details
Take a look at "optarg -s" like in our case:
nfsen.conf:
%sources = (
'xxxnameyy' => { 'port' => '2000', 'IP' => '192.168.1.1', 'col'
=> '#00fff0', 'type' => 'netflow', 'optarg' => '-s 128' },
...
some more info in:
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/nde.html#wp1164287
kind regards,
Gunther
NetCologne Systemadministration
--
NetCologne Gesellschaft für Telekommunikation mbH
Am Coloneum 9 ; 50829 Köln
Geschäftsführer:
Jost Hermanns,
Mario Wilhelm
Vorsitzender des Aufsichtsrates:
Dr. Andreas Cerbe
HRB 25580, AG Köln
------------------------------------------------------------------------------
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
