8 Replies Latest reply on Dec 24, 2014 9:27 AM by choly

    counters wrapping

    mr.snmpsniffer

      Anyone have any issues with counters wrapping or interfaces reporting excess bandwidth.  I have LAN and WAN interfaces reporting 1.2 Gbps on a 1 gig int  and 150 Mbps on an FE interface. Any ideas? interface configs included. 

       

       

      interface GigabitEthernet0/0/0

       

      ip nbar protocol-discovery

      ip flow monitor NTA_Monitor input

      ip flow monitor NTA_Monitor output

      ip pim dr-priority 10

      standby 58 ip

      standby 58 preempt

      standby 58 name

      standby 58 track 1 decrement 10

      negotiation auto

      cdp enable

      service-policy input Lan_Ingress_marking

      end

       

      !

      interface FastEthernet0/1/0

      description

      ip address

      ip nbar protocol-discovery

      ip flow monitor NTA_Monitor input

      ip flow monitor NTA_Monitor output

      no negotiation auto

      service-policy output Egress-to-

      end

        • Re: counters wrapping
          HolyGuacamole

          Assuming this is in the netflow charts. Why chart specifically? A screenshot would help

          • Re: counters wrapping
            superfly99

            When you look at the Interface Details, what does it say for Interface Bandwidth?

            Capture.JPG

             

            It looks like Solarwinds sees them as slower interfaces than what they are. You can manually set the speed by selecting the interface in Manage Nodes and then click on Edit Properties. Then tick the Custom Bandwidth option and fill in the speed. Click on Submit when done.

            Capture.JPG

             

            The other thing you could do is turn on "Allow 64 bit counters" in Node Management and then Edit Properties.

            Capture.JPG

            • Re: counters wrapping
              mr.snmpsniffer

              Interface shows as 100 Meg but it lists as 100 meg TX and 100 Meg RX.  Throughput numbers are correct.  Its just the flow numbers are wrong…

               

              Screen Shot 2014-09-30 at 10.53.58 AM.png

               

              These images are using the flow navigator isolating to just the FE interface. 

              Screen Shot 2014-09-30 at 10.47.53 AM.png

              Screen Shot 2014-09-30 at 10.55.39 AM.png

              • Re: counters wrapping
                Craig Norborg

                What kind of device is this?  What does your "Flow Record" look like?   Can you post your entire Netflow configuration?

                • Re: counters wrapping
                  mr.snmpsniffer

                  sh inventory

                  NAME: "Chassis", DESCR: "Cisco ASR1001 Chassis w/o IDC"

                  PID: ASR1001 

                   

                  asr1001-universalk9.03.12.01.S.154-2.S1-std.bin

                   

                  flow record NTA_Record

                  match ipv4 protocol

                  match ipv4 source address

                  match ipv4 destination address

                  match transport source-port

                  match transport destination-port

                  match transport tcp destination-port

                  match transport udp destination-port

                  match interface input

                  match interface output

                  collect interface input snmp

                  collect interface output snmp

                  collect counter bytes long

                  collect counter packets long

                  collect timestamp sys-uptime first

                  collect timestamp sys-uptime last

                  !

                  !

                  flow exporter NTA_Exporter

                  description SolarwindsServer

                  destination 10.42.4.140

                  source GigabitEthernet0/0/0

                  transport udp 2055

                  !

                  !

                  flow monitor NTA_Monitor

                  exporter NTA_Exporter

                  cache timeout active 60

                  statistics packet protocol

                  record NTA_Record

                  !

                   

                  interface FastEthernet0/1/0

                  description NA

                  ip address NA

                  ip nbar protocol-discovery

                  ip flow monitor NTA_Monitor input

                  ip flow monitor NTA_Monitor output

                  no negotiation auto

                  service-policy output Egress-to-XO

                    • Re: counters wrapping
                      Craig Norborg

                      Hmmm...  I think your flow record is causing the problem.    I believe the flow record needs to be in a certain format, or at least close to the format that solarwinds wants to look for...

                       

                      Here is a document that covers several types of netflow configurations for solarwinds.

                      http://www.solarwinds.com/documentation/NetFlow/docs/NetFlowDeviceConfiguration.pdf

                       

                      Their flow records look mostly like this:

                      flow record ipv4

                      ! match ipv4 tos

                      match ipv4 protocol

                      match ipv4 destination address

                      match transport source-port

                      match transport destination-port

                      match interface input

                      collect interface output

                      collect counter bytes

                      collect counter packets

                       

                      I did find another example in the Netflow lab that looks like this:

                       

                      flow record NTArec

                      description IPv4 monitor

                      match ipv4 tos

                      match ipv4 protocol

                      match ipv4 source address

                      match ipv4 destination address

                      match transport source-port

                      match transport destination-port

                      match interface input

                      collect routing source as

                      collect routing destination as

                      collect routing source as peer

                      collect routing destination as peer

                      collect routing next-hop address ipv4 bgp

                      collect interface output

                      collect flow direction

                      collect counter bytes

                      collect counter packets

                       

                      I know we tried redefining the Netflow record on one piece of equipment and it didn't work.   Putting it back to a standard config got it working for us again.  Can't remember what that was though, I think it was a Nexus which has a similar configuration method...