Weird Netflow Chart Readings

ncsisnet,

please take a look at this post, I guess you might have same case.

thanks

I'd have thought that was the case as well.  However, that doesn't seem to be the case.

I do have these cache timeout settings in my Cisco interfaces' but they're not helping.

Also, I discovered that if I change the chart to "Line charts" for Conversations, Applications and Endpoints, they showed up with the correct values.  Charts like Protocols and Services remained the same even after changing to line charts.

Also, anything other than a line chart will give me charts with inaccurate values.

weird, can you please clarify this:

 - does selected interface works in full-duplex mode?

 - please can you post screen-shot of Top XX Protocols in Both/Ingress/Egress modes

 - post the netflow config for selected interface/router

thanks

Hi GZhytar,

The interface is indeed working in full-duplex mode.

The selected interface netflow config is:

interface GigabitEthernet0/1
  ip address x.x.x.x x.x.x.x
 ip nbar protocol-discovery
 ip flow ingress
 ip flow egress
 duplex full
 speed 100
end

For the router:

ip flow-cache timeout active 1
ip flow-export source Loopback0
ip flow-export version 5
ip flow-export destination x.x.x.x 9996

Below are the shots for the individual modes

Ingress:

Egress:

Both:

ncsisnet,

I've seen this before for some devices which were exporting incorrect doubled information within NetFlow packets.

Please can you open support ticket and collect 1-2 hour capture of NetFlow data, so we can investigate this more deeply.