2 Replies Latest reply on Jun 25, 2012 10:23 AM by LDave

    Netflow not shown for one interface on a core switch - others work


      Hello everyone,

      We have a datacenter core switch (Cisco Cat 4507) which exports netflow statistics towards our orion server. Statistics is collected for most of the interfaces of the switch but on one (for which the switch shows data and ports used if we connect on it) NTA doesn't seems to collect anything. The interface is the one connected to a building core switch (Cisco Cat 3550 12 G) and we need to monitor traffic between the building and the datacenter, but since the building switch doesn't support Netflow, we need to have NTA working with the core switch related interface.


      How can we troubleshoot this lack of netflow collection from NTA?

      (in this moment, for istance, we have a lot of traffic from one precise client to a server, on port 443, traversing the mentioned interface. We can see this in the netflow directly on the switch, but no data shows on NTA)


      ps. obviously the interface is selected under the interfaces managed by netflow


      Thank you.

        • Re: Netflow not shown for one interface on a core switch - others work

          LDave, is this a layer 2 or layer 3 interface?


          I assume the export is configured the same for all of the interfaces on this switch. You could try to shutdown and re-enable the interface to make sure it picked up the changes to the flow configuration (obviously you would need to do that in a maintenance window).


          To see if the problem is with the device or NTA, you could run wireshark and see if flows are coming from that device. The filter is 'cflow' and you'll want to limit the traffic from that one source. You'll also need to know the interface id to find the right flows (from NPM go to the Interface Details page for that interface and you will see the interface index number).

          1 of 1 people found this helpful
            • Re: Netflow not shown for one interface on a core switch - others work

              Hello mavturner,

              Sorry for the delay I've made few tests with our network guy and we managed to solve the problem.

              I had to add the related vlan under nta monitoring and not the physical port of the core. This is related to the fact that our building uses a different type of connection towards the core than the building in which the core is present.


              Your mention of wireshark and the hint to look for the interface id helped me to narrow down the boundaries of the problem, so thank you.