Configured to export v5 flows, cat6509 running IOS is sourcing 95% v7, and 5% v5. Anyone seen this kind of behaviour? - billn
"Bill" == Bill Nash <billn@billn.net> writes:
Bill> Configured to export v5 flows, cat6509 running IOS is sourcing Bill> 95% v7, and 5% v5. Anyone seen this kind of behaviour? You don't mention what version of IOS or what supervisor/PFC version in the cat. With 12.1 at least, the MSFC doesn't support version 7 flows, so for traffic routed in software you will get a v5 flow, and for traffic routed in hardware you'll get v7 if that's what you configured. If you have sup2/PFC2 and IOS >= 12.1(13), you can configure the PFC to export v5 as well, and get everything in the same format. -- Andrew, Supernews http://www.supernews.com
I've been out of the hands-on config game for a while, so certain portions of my clue is rusting. I knew the MSFC and the SUP both had their own ideas about how things were supposed to go, but (especially with IOS running on switches) wasn't 100% on the configuration behaviour. I can look at the configs and see that v5 export is configured, but I don't see an instruction to the SUP to export v5, which is what's tripping up my collection. Netflow being something our engineers haven't worked with extensively, and required configurations on recent IOS on Cats being something I'm not up to speed on, there's a a divide between me saying it's broken, and them saying that it's configured and that my tools are broken. So there's head scratching and finger pointing on both sides that just needed a nudge. The versions didn't make the difference, the clued respondants still saw the break for what it was. Thanks again. - billn On Wed, 8 Jun 2005, Andrew - Supernews wrote:
"Bill" == Bill Nash <billn@billn.net> writes:
Bill> Configured to export v5 flows, cat6509 running IOS is sourcing Bill> 95% v7, and 5% v5. Anyone seen this kind of behaviour?
You don't mention what version of IOS or what supervisor/PFC version in the cat.
With 12.1 at least, the MSFC doesn't support version 7 flows, so for traffic routed in software you will get a v5 flow, and for traffic routed in hardware you'll get v7 if that's what you configured.
If you have sup2/PFC2 and IOS >= 12.1(13), you can configure the PFC to export v5 as well, and get everything in the same format.
-- Andrew, Supernews http://www.supernews.com
participants (2)
-
Andrew - Supernews -
Bill Nash