I'm looking for some pointers from someone who has gotten this working correctly. The 6509 (native mode) is configured as shown in this page from cisco:
I think we are pretty close because I see the flow data I want (userA -> serverB on portC) when running show mls netflow ip [..] - so the pfc/mls side for netflow is set up and collecting as shown on the 6509 itself, but not all of those flows show up in Orion. I'm specifically looking for a telnet session from a user in vlan A hitting a server in vlan B - that flow is in the data output from show mls netflow, along with many other user connections, same server, same port. In Orion, all i see for flows on either vlan interface are some bootp and netbios traffic - no tcp traffic at all, and not the flows I see listed in show mls netflow. I'm not completely missing data, because i get this little dribble of bootp/netbios, but I don't seem to have any of the data from the pfc.
For configuration, we have done everything in the above link for native mode with the exception of the NDE and optional configuration sections. We did not do the NDE section because the doc says this:
"If you use the NetFlow data collector to store the historical NetFlow traffic, you need to configure the NDE on the Catalyst 6500 Switch."
Since we don't want to store historical netflow data on the switch itself, but instead have Orion store it - we don't need this - or am I reading this incorrectly?
Is there something I'm missing that would relate to the export of that data over to Orion, and would account for some traffic showing up but not all, even when its in the output of show mls netflow?
Thanks for the help!
