I think you'll have to ask Cisco that one.
If they're exporting the underlying data ntop should see it. If the CEF data is encapsulated and Cisco's netFlow is ignoring it, well, then ... -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Joseph Ezerski Sent: Thursday, April 03, 2003 1:21 PM To: [EMAIL PROTECTED] Subject: [Ntop] ntop 2.1.90 and CEF I have recently started using ntop and have a specific question regarding the use of Netflow from Cisco routers running CEF: -I am running ntop 2.1.90 on a Redhat Linux 8 box installed from the sourceforge RPM -Platform is an Intel based Dell GX150 Tower with 256 MB RAM P3 700 Mhz -Using these options: ntop -u ntop -P /usr/share/ntop -i eth0 -g -w 3000 -m 10.0.0.0/8 -D broadcom.com -p /usr/share/ntop/Protocols/protocols.ntop -d -I am trying to setup netflow export from a Cisco 6509/MSFC multilayer switch running CEF. -I set up the netflow plug-in on ntop, including the port (default 2055) -I set up the netflow export and destination (version 5) on my MSFC router and enabled netflow switching under the specific interface. I do see some traffic stats in ntop, but the flow sizes are very small (only a few K). I think this has something to do with how multilayer switching works and it is only seeing the first packet in each flow. Does ntop work when you are exporting netflow stats directly from a router running CEF? Or do I need to setup nProbe with an associated SPAN port and then export that flow data to ntop? Has anyone worked with CEF, netflow and ntop successfully? -Joe _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
