Netflow Traffic Analyzer not showing all traffic...

We have a VLAN configured with 'ip flow ingress', but not all data seems to be captured. A 'show mls netflow ip' shows hundreds of flows for this VLAN, but we only see minimal administrative data in NTA (bgp, netbios, syslog).

Any thoughts? Relevant config:

ip flow-cache timeout active 1

mls netflow interface

mls flow ip interface-full

ip flow-export source Loopback0

ip flow-export version 5

mls nde sender

Find more posts tagged with

Accepted answers

All comments

GoldTipu

Hi Suffah

I would first suggest you to run a wireshark and filter for the ip address source or cflow packet in order to verify the incomming traffic hitting Orion Netflow service port (amount of packets) . Also i would recommend you to open a support ticket on this as well.

Regards

mavturner

suffah,

Do you see a category called unmonitored traffic in your graphs? If so, you may want to enable monitoring on all ports to make sure you are seeing those other ports (Settings-NTA Settings).

Mav

suffah

I grabbed a wireshark cap and it looks like data is being received. For example, I see 25Mbps on an interface but when I click it for details it only shows a few minor entries.

However, we are using netflow v5 but wireshark shows it as version 7. Does this have anything to do with nde?

Mav, there is unmonitored traffic but it is only a few kbytes compared to the tons of traffic I should be seeing.

Thanks all.