The "Netflow Config On 6509" post

I have all of the commands needed to setup ingress and egress on a 6509. I will post them tomorrow when i get back to the office.

but to answer your question, I had to manually configure every port that i wanted to monitor. I ended up just setting up Ingress and egress on the vlan instead.

Thats interesting.  I posted this same question on cisco's netpro forum and was told by two different people that there was not a way to monitor layer2 interfaces, only layer3.  I thought I saw somewhere that there was a way to do layer2.

Are you setting up ingress/egress on layer3 vlan interfaces?  I found that does work.

Here is a link to a Cisco document that goes through the steps for configuring Netflow on 6500 series swtches, both hybrid and native IOS.  They key command to monitor layer 2 is " ip flow ingress layer2-switched vlan xxxx". Also verify the NDE version is version 5, by default version 7 is configured.

www.cisco.com/.../netflow-catalyst6500.pdf

Hope this helps

Use the code below to monitor a vlan. But you could also replace interface Vlan??? with interface GigabitEthernet1/41 or any other port that you want to monitor.

ip flow-cache timeout active 1
!
mls aging fast time 8 threshold 127
mls aging normal 32
mls flow ip full
no mls flow ipv6
mls nde sender version 7
!
interface Vlan???
 description **???**
 ip address ???.???.???.??? ???.???.???.???
 ip pim sparse-dense-mode
 ip route-cache flow
 ip igmp snooping mrouter interface GigabitEthernet1/48
!
interface Vlan???
 description **???**
 ip address ???.???.???.??? ???.???.???.???
 ip pim sparse-dense-mode
 ip route-cache flow
 mls netflow sampling
!
interface Vlan???
 description **???**
 ip address ???.???.???.??? ???.???.???.???
 ip helper-address ???.???.???.???
 ip flow ingress
 ip pim sparse-dense-mode
 ip route-cache flow
 mls netflow sampling
!
ip flow-export source Vlan???
ip flow-export destination ???.???.???.???
!
end

One other thing to keep in mind when trying to monitor layer 2 interfaces for NetFlow on 6500s.  In order to get both routed and bridged traffic from Netflow, you'll need either a PFC3B or PFC3BXL running IOS 12.2(18) SXE or later.  If you have a PFC3A or you're running IOS code earlier than 12.2(18)SXE, you'll only get routed traffic stats.

good catch. I forgot to put that in there.

Thanks.  After having spent a stupid amount of time trying to find out why I couldn't get layer 2 traffic from a 6509 with a PFC3A card, I figured I'd try to save someone else from the same waste of time!