10 Replies Latest reply on Apr 16, 2010 8:59 AM by jswan

    Monitoring NetFlow from a PPP interface...

      I've found a bit of an issue when using NPM and NetFlow Analyzer together.

      Keep in mind, I would like to monitor as few interfaces as possible to keep licensing down.


      First, I set up NPM.  I have 50 routers, and I added ONLY their T1 interfaces.  I did this instead of PPP interfaces so that I could also get things like error stats, MAC address, etc.

      I then set up NetFlow Analyzer.  Obviously, I need to source the NetFlow traffic from somewhere, but I can't do it from the T1 interface.  I can do it from the internal VLAN, or the PPP interface.  When I source it from the PPP interface, it works fine, but now I have effectively doubled the amount of interfaces I'm monitoring.  This is annoying because the PPP interface doesn't show me any of the SNMP stats.


      Anyone find a good way to get around this?

        • Re: Monitoring NetFlow from a PPP interface...
          Andy McBride

          I'm  having a little trouble following your set up. Can you give me an idea of the topology and what you want to see?

            • Re: Monitoring NetFlow from a PPP interface...

              Yeah, sorry about that.  Here is a quick image of the setup (the important part, at least).  All I'm trying to monitor is the T1 at the remote site.



              So, originally when adding nodes to NPM, I would select the router, and told it to monitor the T1 1/1 interface.  Doing this allowed me to see stats like error counters, etc, thanks to SNMP.  

              The problem with that, though, is that the T1 1/1 interface doesn't have an IP address - the logical PPP1 interface has the IP.  

              When I configure NetFlow on the router, I have to tell it where to source the NetFlow traffic from.  I can only source the traffic from an interface with an IP address (ie: must be a layer3 interface).  So I tell it to source from the PPP1 interface.


              Now I am monitoring 2 interfaces, although they are really one in the same.  Within NPM, I need the T1 1/1 interface because it holds SNMP statistics.  Within NetFlow, I need PPP1 since it sends NetFlow traffic.


              Does that make more sense?


              Edit: As a side note - the reason this is annoying is because I am now effectively doubling the total amount of interfaces being monitored.  Also, it's a little more cluttered since I don't have one interface with ALL information.