Hi all,
I'm currently exporting Netflow from my Cisco 6504-e switches, and am using NTA 3.8. Recently, I seem to have completely lost all of my BGP AS information.
When I first installed my NPM and NTA trials, it automatically installed SQL Compact for me. For a while, everything was absolutely fine - I could see all of my Netflow information, including full BGP AS information in the BGP tab. Top Autonomous Systems and Top Autonomous System Conversations both worked perfectly and gave me the info I expected to see.
However, I soon hit the 4GB database size limit for SQL Compact, so I installed a new SQL server (SQL Server 2008 R2) on a seperate machine. I deleted the old database, and pointed NPM/NTA to the new one (meaning that it deleted the old data, of course).
Since using the new database, almost everything seems fine. I'm still seeing the same Netflow information I'm used to seeing (ie Top Apps, Top Endpoints, Top Countries etc... all of these are fine), but I've completely lost all BGP AS information. No matter what summary view I select or which interface I check, all I see when I look for BGP AS information is "No Data for Selected Time Period".
I'm really confused because I haven't changed anything other than the database - the config on the switches is exactly the same (I'll paste it below for reference). Also, if I run a "show ip cache verbose flow", I can see that the BGP AS information is being cached on the switches (and therefore, presumably, exported also). I'm really stumped and can't figure out why it's not working.
Here's my config:
mls nde interface
mls nde sender version 5
mls flow ip interface-full
!
ip flow-export source loopback 0
ip flow-export version 5 origin-as
ip flow-export destination [collector ip] 2055
!
ip flow ingress layer2-switched vlan 1-4094
ip flow-cache timeout active 1
!
mls aging long 64
mls aging normal 64
!
mls sampling packet-based 1024 8192
!
interface [interface name]
mls netflow sampling
Here's a snippet of the output from "show ip cache verbose flow". Some of the ASs that are being recorded are AS20940, AS19795 and AS28271:
SrcIf SrcIPaddress DstIf DstIPaddress Pr TOS Flgs Pkts
Port Msk AS Port Msk AS NextHop B/Pk Active
-------------------------------------------------------------------------------
Displaying hardware-switched flow entries in the PFC (Active) Module 1:
SrcIf SrcIPaddress DstIf DstIPaddress Pr TOS Flgs Pkts
Port Msk AS Port Msk AS NextHop B/Pk Active
Vl51 [snipped] Vl183 [snipped] 06 00 00 5
0050 /24 20940 3615 /0 0 [snipped] 0 0.0
Vl115 [snipped] Vl51 [snipped] 06 00 00 1
0019 /28 0 C7FA /24 19795 [snipped] 0 0.0
Vl115 [snipped] Vl51 [snipped] 06 00 00 1
0019 /28 0 D95C /24 28271 [snipped] 0 0.0
I'd really appreciate any suggestions that anyone might have, since I'm completely out of ideas!!
Cheers 
