pisalem juz o tym problemie na pl.comp.sieci - ale na razie cisza, wiec moze tutaj jednak ktos bedzie wiedzial bo mi sie pomysly skonczyly juz ...
soft 12.2-31
conf jest taki:
[...]
ip flow-cache timeout inactive 10
ip flow-cache timeout active 15
ip cef distributed
[...]
na kazdym z ifow ( fastethernety ):
ip route-cache flow
(domyslnie jest tez ip route-cache distributed)
[...]
ip flow-export version 5
ip flow-export destination xx.xx.xx.xxx yyyy
Wszystko fajnie pieknie tylko ze gdy na maszynie ktora odbiera tego netflowa
soft analizujacy twierdzi: Error reading netflow header: Unexpected netflow
version 256
Zapisalem kilka pakietow z tego ciskacza tcpdumpem, lookam przez ethereal
nf.pcap, analize ustawiam jako UDP/CFLOW ( cisco flow ) i ... w kazdym
pakiecie widze "version 1" - dlaczego ?
Spotkal sie ktos z takim problemem albo "co robie zle"
?Aha - co ciekawsze, VIPy sa chyba tez ustawione na version 5, gdyz po
if-con:
VIP-Slot1>show ip flow export
Flow export v5 is enabled for main cache
Exporting flows to xx.xx.xx.xxx (yyyy)
Exporting using source IP address xx.xx.xx.xxx2
Version 5 flow records
39692000 flows exported in 1742413 udp datagrams
0 flows failed due to lack of export packet
0 export packets were sent up to process level
0 export packets were dropped due to no fib
0 export packets were dropped due to adjacency issues
0 export packets were dropped due to fragmentation failures
0 export packets were dropped due to encapsulation fixup failures
0 export packets were dropped enqueuing for the RP
0 export packets were dropped due to IPC rate limiting
