Netflow not shown for one interface on a core switch - others work

LDave

Hello everyone,

We have a datacenter core switch (Cisco Cat 4507) which exports netflow statistics towards our orion server. Statistics is collected for most of the interfaces of the switch but on one (for which the switch shows data and ports used if we connect on it) NTA doesn't seems to collect anything. The interface is the one connected to a building core switch (Cisco Cat 3550 12 G) and we need to monitor traffic between the building and the datacenter, but since the building switch doesn't support Netflow, we need to have NTA working with the core switch related interface.

How can we troubleshoot this lack of netflow collection from NTA?

(in this moment, for istance, we have a lot of traffic from one precise client to a server, on port 443, traversing the mentioned interface. We can see this in the netflow directly on the switch, but no data shows on NTA)

ps. obviously the interface is selected under the interfaces managed by netflow

Thank you.

mavturner

LDave, is this a layer 2 or layer 3 interface?

I assume the export is configured the same for all of the interfaces on this switch. You could try to shutdown and re-enable the interface to make sure it picked up the changes to the flow configuration (obviously you would need to do that in a maintenance window).

To see if the problem is with the device or NTA, you could run wireshark and see if flows are coming from that device. The filter is 'cflow' and you'll want to limit the traffic from that one source. You'll also need to know the interface id to find the right flows (from NPM go to the Interface Details page for that interface and you will see the interface index number).