0 Replies Latest reply on Apr 21, 2009 2:00 PM by hoodbu

    'Monitored Interfaces' under 'Edit NetFlow Sources'


      I'm using NetFlow Traffic Analysis v 9.0 SP1 with Cisco devices.

      I have a few questions about what is displayed when I go to 'Edit NetFlow Sources' and look at the 'Monitored Interfaces'.

      Q1) For example, I don't understand why some interfaces show up as 'Exporters only (last 15 minutes)' and others don't. I guess one reason could be because 'ip route-cache flow' might not be enabled on all interfaces. What could be other possibilities? There is a lot of traffic flowing through all interfaces.

      Q2) Also, I see one interface on a particular node displayed as follows:

                                                                                                             GigabitEthernet8/37 · sbtfe04(and 03)                                         

      What does the text after the bullet indicate? It certainly isn't the Description because that is something else as shown below.

      Q3) Keep in mind that there is no entry for GigabitEthernet8/36 as a possible 'Monitored Interface'. In reality, the configs of Gi8/36 and Gi8/37 show up as follows:

      interface GigabitEthernet8/36
       description mgmt-dev-8015
       ip address
       standby 12 ip
       standby 12 timers 1 3
       standby 12 priority 110
       standby 12 preempt
      interface GigabitEthernet8/37
       description mgmt-dev-8016
       ip address
       standby 13 ip
       standby 13 timers 1 3
       standby 13 priority 110
       standby 13 preempt

      As you can see, the configs are near identical and traffic is flowing through both. Yet, one shows up as an Exporter (and hence potential Monitored interface), but the other doesn't. Either they both have 'ip route-cache' enabled or they both don't.
      Moreover, the text after the bullet doesn't match the Description. So where did that 'sbtfe04(and 03)' text come from?