Netflow issue

whats the difference between ipbase ios and ipservices.
Even i updated the WS-C3750E-48TD-S with ip base on cisco switch and configured the swtich wiht net flow commands
ip net flow commands working fine but i am unable to see the packets from switch and unable to monitor the net flow.
interface Vlan1
 ip route-cache flow
 ip flow ingress
 ip address 10.144.108.1 255.255.255.0
 ip access-group TEST in
 ip access-group TEST out
 ip accounting output-packets
interface Vlan2
 ip route-cache flow
 ip flow ingress
 ip flow egress
 ip address 10.144.0.100 255.255.255.0
ip flow-export version 5
ip flow-export destination 10.144.108.212 2055
ip flow-top-talkers
 top 50
 sort-by packets
ip route 0.0.0.0 0.0.0.0 10.144.0.1
ip access-list extended TEST
 permit icmp any any log
 permit tcp any any log
 permit udp any any log
 permit ip any any log
l
snmp-server community private RW
snmp-server enable traps syslog
snmp-server host 10.144.108.212 version 2c private
snmp ifmib ifindex persist
whats the issue please help me out!

Re the image difference, here is a quote from the data sheet:
IP Base software includes advanced quality of service (QoS), rate limiting, access control lists (ACLs), Open Shortest Path First (OSPF) for routed access, and IPv6 functionality.
IP Services software provides a broader set of enterprise-class features, including advanced hardware-based IP Unicast and IP Multicast routing, as well as policy-based routing (PBR).
Re Netflow, I've never had good luck getting NetFlow from a L2/L3 switch other than a higher-end model with the hardware support - i.e.,  4500 with Netflow Feature card, 6509 or 3750X with the Netflow network service module installed. I beleive the new 2960X models also have the necessary hardware support.
On other switches, the SVIs do not export the flow correctly even though the IOS allows you to enter the commands. I'm told it's due to hardware limitations as there need to be ASICs supporting the flow sampling. Reference.

Similar Messages

  • MPLS VPN / BGP Netflow Issue

    I have followed all of the configuration steps given for egress accounting with netflow on a MPLS VPN link. However, it is only showing flows coming into the router. I need to be able to account both ways- any recommendations? Config below:
    interface Multilink12
    mtu 1580
    ip address XX.XX.XX.XX 255.255.255.252
    no ip redirects
    no ip unreachables
    ip pim sparse-mode
    ip route-cache flow
    mpls netflow egress
    mpls label protocol ldp
    mpls ip
    ppp multilink
    ppp multilink group 12
    ip flow-export source FastEthernet0/0/0.10
    ip flow-export version 5
    ip flow-export destination XX.XX.XX.XX 9996
    IP packet size distribution (10730093 total packets):
    1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480
    .000 .098 .645 .011 .016 .012 .009 .010 .000 .001 .000 .001 .000 .000 .000
    512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
    .000 .000 .000 .002 .185 .000 .000 .000 .000 .000 .000
    IP Flow Switching Cache, 4456704 bytes
    4 active, 65532 inactive, 464700 added
    6109192 ager polls, 0 flow alloc failures
    Active flows timeout in 1 minutes
    Inactive flows timeout in 15 seconds
    IP Sub Flow Cache, 336520 bytes
    0 active, 16384 inactive, 20706 added, 20706 added to flow
    0 alloc failures, 0 force free
    1 chunk, 1 chunk added
    last clearing of statistics never
    Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)
    -------- Flows /Sec /Flow /Pkt /Sec /Flow /Flow
    TCP-Telnet 7 0.0 20 233 0.0 7.0 11.3
    TCP-FTP 3 0.0 1 40 0.0 0.4 1.6
    TCP-WWW 5757 0.0 6 389 0.0 1.1 3.0
    TCP-SMTP 7 0.0 1 40 0.0 0.7 1.6
    TCP-X 244 0.0 1 54 0.0 0.0 1.5
    TCP-other 304762 0.2 7 346 1.6 2.2 4.8
    UDP-DNS 346 0.0 1 127 0.0 0.0 15.4
    UDP-NTP 3323 0.0 1 80 0.0 0.0 15.4
    UDP-other 131041 0.0 62 341 5.4 17.6 13.2
    ICMP 64291 0.0 1 79 0.0 0.0 15.4
    Total: 509781 0.3 21 341 7.1 5.9 8.3
    SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts
    Mu12 10.50.66.218 Null 10.105.0.1 11 0675 00A1 84
    Mu12 10.50.66.218 Null 10.105.19.10 11 0675 00A1 2
    Mu12 10.50.66.218 Null 10.105.19.3 11 0675 00A1 4
    Mu12 10.50.66.42 Null 10.105.19.10 06 0B3C 01BD 12

    Update on this- Im now receiving all traffic incoming into the interface, but am tracking only about 10% of the outgoing traffic- revised config below:
    ip flow-cache timeout active 1
    ip flow-cache mpls label-positions 1 2 3
    ipv6 flow-cache mpls label-positions 1 2 3
    interface Multilink12
    mtu 1580
    ip address XX.XX.XX.XX 255.255.255.252
    no ip redirects
    no ip unreachables
    ip flow ingress
    ip flow egress
    ip pim sparse-mode
    ip route-cache flow
    mpls netflow egress
    mpls label protocol ldp
    mpls ip
    ppp multilink
    ppp multilink group 12
    service-policy output cbwfq-voice20per
    ip flow-export source FastEthernet0/0/0.10
    ip flow-export version 9 origin-as
    ip flow-export destination XX.XX.XX.XX 9996

  • Flexible NetFlow Causing DNS Issues

    I recently deployed Flexible NetFlow on some of my 2821 routers (Version 12.4(9)T3). This was required because I needed to export my flow records via an IPSEC / GRE tunnel, and traditional NetFlow wouldn't encapsulate within the IPSEC tunnel. So I migrated to Flexible NetFlow. As soon as I did this all DNS queries from hosts on the inside network began to fail. has anyone seen this issue? Is there a fix? Currently I have simply turned off NetFlow collection on the routers in question.
    Config:
    flow exporter StoFlowExporter
    destination 10.x.x.x
    source GigabitEthernet0/0.461
    transport udp 2055
    flow monitor StoNetFlow
    record netflow ipv4 original-input
    exporter StoFlowExporter
    interface GigabitEthernet0/0.461
    description LAN
    encapsulation dot1Q 461
    ip address 10.x.x.x 255.255.255.0
    ip access-group LAN_Outbound in
    ip flow monitor StoNetFlow input
    ip nat inside
    ip virtual-reassembly
    Thanks,

    It sound like you somehow have have got the ethernet 2 interface as the topmost interface in the Network settings "service order" which is a good thing for routing. The 192.168.1.0/24 network interface doesn't need a router setting but it will work as it is.
    The modem is really also working as a NAT router and probably sending out IPs through DHCP to machines on that subnet (the Server's "WAN"), but the server needs to have a static IP on that subnet so you can add it to your DNS server settings instead of 192.168.1.3 (or use both IPs in DNS server config for the same name but it's probably better to have only one because of the reverse IP lookup) as the machine will use the topmost interface as the default for it's name and services. The server will answer on the 192.168.1.3 inteface too for most services. If the server does NAT (probably is running the firewall and NAT?) Internet access should work without any static routes in the modem/router but you will have dual NAT from the server LAN (192.168.1.0/24 subnet).
    Both these subnets IP-"ranges" isn't using recommended values if you want to use the server for VPN later, as either one of those is the default on most broadband routers.
    Your setup looks like modem/router<-->server en port 2>--<server en port 1>---LAN switch<--->LAN client computers?
    You probably don't need to use both interfaces on the server as you (can/should) use only your modem/router for NAT but some people want to run the firewall in OS X server especiallay if forwarding a "DMZ" port from their internet router to the server IP.
    Just the servername should be in the "Sharing" setup and the domainname in "Search domain" field in Network config.
    So in your case "smcoserver" and "private" respectively.

  • Cisco Prime- Netflow Export Issue

    Dear All,
    We are observing high bandwidth being utliized between ASR1004 and Cisco Prime 2.1 after enabling "ip netflow exporter". Is there any way to mitigate it..?

    Yes - use sampled Netflow which statistically samples the flows instead of trying to send every single one back to Prime Infrastructure.
    The IOS-XE configuration guide section on Netflow describes how to set it up.

  • ASR netflow with third party tool

    Hi ,
    we have one issues where netflow data is not getting into the solar winds tool.in wireshark captures it shows netflow traffic is reaching upto the server.
    found one  forums and they highlighted one bug as below but its not affecting the release we are having.unable to find the exact bug ID in cisco .let me know if you can get any inputs and highlight the same.
    below is the links and current details
    https://thwack.solarwinds.com/thread/32146
    current ASR version & related netflow config is attached.diesnt find any issue with the configuration .trying with another vendor tool as well and will check .
    asr1002x-universal.03.10.01.S.153-3.S1-ext.SPA.bin
    show  ip flow export cache flow  
    IP packet size distribution (1317M total packets):
       1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480
       .000 .040 .023 .006 .004 .004 .030 .004 .002 .005 .004 .006 .002 .001 .000
        512  544  576 1024 1536 2048 2560 3072 3584 4096 4608
       .000 .000 .047 .029 .781 .000 .000 .000 .000 .000 .000
    IP Flow Switching Cache, 0 bytes
      0 active, 0 inactive, 24710853 added
      417778 ager polls, 0 flow alloc failures
      Active flows timeout in 30 minutes
      Inactive flows timeout in 15 seconds
      last clearing of statistics never
    Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)
    --------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow
    TCP-Telnet           5      0.0        61    42      0.0      31.1      31.2
    TCP-FTP             52      0.0        20    85      0.0      14.3      30.9
    TCP-FTPD             8      0.0        71    51      0.0       3.6      31.1
    TCP-WWW         369465      0.0        15   694      1.3       7.2      30.9
    TCP-SMTP           417      0.0        84    98      0.0       5.8      30.9
    TCP-X                3      0.0         7   277      0.0       1.6      31.1
    TCP-BGP          10911      0.0         1    69      0.0       3.0      30.9
    TCP-other     19793896      4.6        28  1134    131.5       2.6      30.9
    UDP-DNS         320124      0.0         1    79      0.0       0.0      30.9
    UDP-NTP          65307      0.0         1    87      0.0       0.1      30.9
    UDP-TFTP           854      0.0         1    51      0.0       0.0      30.9
    UDP-Frag          1721      0.0         7    58      0.0       2.1      30.9
    UDP-other      3850147      0.8       192  1244    172.6       3.7      30.9
    ICMP            296732      0.0         3    62      0.2       4.2      30.9
    Total:        24709642      5.7        53  1193    305.8       2.8      30.9
    SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts

    HI Mike,
    If you have third party Document Management System, then you can post two different message, i.e. service order in transaction details of the third party tool with link to document which would be posted to third party Document management server.
    If you don't have third party document management system and what to use sap infrastructure, then you don't need to maintain attachment, maintain the link between the third party tool and SAP document repository, with some login utilities.
    Best Regards,
    Pratik Patel.
    Reward with points if it is of any help to you!

  • Flexible Netflow (v.9) question on 3850 ipservices doesn't seem to register

    Greetings all - I am trying to enable netflow on a new 3850-24 with ipservices.  I am leveraging LiveAction and have raised a ticket with them to help me through the issue, but more generally I'm confused about the lack of features I'm seeing. Per the 3850 guide here (http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/flexible_netflow/configuration_guide/b_fnf_3se_3850_cg/b_fnf_3se_3850_cg_chapter_010.html) it is stated that you will have the option of turning on inbound and outbound directions on 3850's with ipbase and ipservices.  
    We are running ip services:
     Slot#  License name   Type     Count   Period left 
     1      ipservices   permanent     N/A   Lifetime
    However, we get the following error when trying to turn on flow inbound and outbound on the interfaces - whether they are svi (layer3) or interface (layer2)
    -----------------Layer2: ----------------------------------------------
    (config)#interface GigabitEthernet1/0/24
    switch(config-if)#ip flow monitor LIVEACTION-FLOWMONITOR input
    switch(config-if)#ip flow monitor LIVEACTION-FLOWMONITOR output
    % Flow Monitor: Flow Monitor 'LIVEACTION-FLOWMONITOR' 
    Unsupported match field "interface input" for ipv4 traffic in output direction
    Unsupported collect field "interface output" for ipv4 traffic in output direction
    ---------------- Layer3 ---------------------------------------------
    switch(config)#interface Vlan190
    switch(config-if)#ip flow monitor LIVEACTION-FLOWMONITOR input
    % Flow Monitor: Flow Monitor 'LIVEACTION-FLOWMONITOR' flexible netflow not supported on vlan interfaces
    switch(config-if)#ip flow monitor LIVEACTION-FLOWMONITOR output
    % Flow Monitor: Flow Monitor 'LIVEACTION-FLOWMONITOR' flexible netflow not supported on vlan interfaces
    ------------------------------------ untruncated output ------------------------------
    switch(config-flow-record)#collect counter bytes
    % Incomplete command.
    switch(config-flow-record)#collect counter packets
    % Incomplete command.
    switch(config-flow-record)#collect flow sampler
                                                        ^
    % Invalid input detected at '^' marker.
    switch(config-flow-record)#collect interface output
    switch(config-flow-record)#collect ipv4 destination mask
                                                    ^
    % Invalid input detected at '^' marker.
    switch(config-flow-record)#collect ipv4 dscp
                                                    ^
    % Invalid input detected at '^' marker.
    switch(config-flow-record)#collect ipv4 id
                                                    ^
    % Invalid input detected at '^' marker.
    switch(config-flow-record)#collect ipv4 source mask
                                                    ^
    % Invalid input detected at '^' marker.
    switch(config-flow-record)#collect ipv4 source prefix
                                                    ^
    % Invalid input detected at '^' marker.
    switch(config-flow-record)#collect routing destination as
                                                   ^
    % Invalid input detected at '^' marker.
    switch(config-flow-record)#collect routing next-hop address ipv4
                                                   ^
    % Invalid input detected at '^' marker.
    switch(config-flow-record)#collect routing source as
                                                   ^
    % Invalid input detected at '^' marker.
    switch(config-flow-record)#collect timestamp sys-uptime first
                                                             ^
    % Invalid input detected at '^' marker.
    switch(config-flow-record)#collect timestamp sys-uptime last
                                                             ^
    % Invalid input detected at '^' marker.
    switch(config-flow-record)#collect transport tcp flags
    switch(config-flow-record)#exit
    switch(config)#flow monitor LIVEACTION-FLOWMONITOR
    switch(config-flow-monitor)#$ DO NOT MODIFY. USED BY LIVEACTION. 
    switch(config-flow-monitor)#exporter LIVEACTION-FLOWEXPORTER
    switch(config-flow-monitor)#cache timeout inactive 10
    switch(config-flow-monitor)#cache timeout active 60
    switch(config-flow-monitor)#record LIVEACTION-FLOWRECORD
    switch(config-flow-monitor)#exit
    switch(config)#interface Vlan197
    switch(config-if)#ip flow monitor LIVEACTION-FLOWMONITOR input
    % Flow Monitor: Flow Monitor 'LIVEACTION-FLOWMONITOR' flexible netflow not supported on vlan interfaces
    switch(config-if)#ip flow monitor LIVEACTION-FLOWMONITOR output
    % Flow Monitor: Flow Monitor 'LIVEACTION-FLOWMONITOR' flexible netflow not supported on vlan interfaces
    switch(config-if)#exit
    switch(config)#interface Vlan190
    switch(config-if)#ip flow monitor LIVEACTION-FLOWMONITOR input
    % Flow Monitor: Flow Monitor 'LIVEACTION-FLOWMONITOR' flexible netflow not supported on vlan interfaces
    switch(config-if)#ip flow monitor LIVEACTION-FLOWMONITOR output
    % Flow Monitor: Flow Monitor 'LIVEACTION-FLOWMONITOR' flexible netflow not supported on vlan interfaces
    -------------------- config it's trying to apply----------------------------
    config t
    ip cef
    snmp-server ifindex persist
    flow exporter LIVEACTION-FLOWEXPORTER
    description DO NOT MODIFY. USED BY LIVEACTION.
    destination <removed private IP address to liveaction server>
    source Loopback0
    transport udp 2055
    template data timeout 600
    option interface-table
    exit
    flow record LIVEACTION-FLOWRECORD
    description DO NOT MODIFY. USED BY LIVEACTION.
    match flow direction
    match interface input
    match ipv4 destination address
    match ipv4 protocol
    match ipv4 source address
    match ipv4 tos
    match transport destination-port
    match transport source-port
    collect counter bytes
    collect counter packets
    collect flow sampler
    collect interface output
    collect ipv4 destination mask
    collect ipv4 dscp
    collect ipv4 id
    collect ipv4 source mask
    collect ipv4 source prefix
    collect routing destination as
    collect routing next-hop address ipv4
    collect routing source as
    collect timestamp sys-uptime first
    collect timestamp sys-uptime last
    collect transport tcp flags
    exit
    flow monitor LIVEACTION-FLOWMONITOR
    description DO NOT MODIFY. USED BY LIVEACTION.
    exporter LIVEACTION-FLOWEXPORTER
    cache timeout inactive 10
    cache timeout active 60
    record LIVEACTION-FLOWRECORD
    exit
    interface Vlan197
    ip flow monitor LIVEACTION-FLOWMONITOR input
    ip flow monitor LIVEACTION-FLOWMONITOR output
    exit
    interface Vlan190
    ip flow monitor LIVEACTION-FLOWMONITOR input
    ip flow monitor LIVEACTION-FLOWMONITOR output
    exit
    interface GigabitEthernet1/0/13
    ip flow monitor LIVEACTION-FLOWMONITOR input
    ip flow monitor LIVEACTION-FLOWMONITOR output
    exit
    interface GigabitEthernet1/0/18
    ip flow monitor LIVEACTION-FLOWMONITOR input
    ip flow monitor LIVEACTION-FLOWMONITOR output
    exit
    interface GigabitEthernet1/0/4
    ip flow monitor LIVEACTION-FLOWMONITOR input
    ip flow monitor LIVEACTION-FLOWMONITOR output
    exit
    interface GigabitEthernet1/0/3
    ip flow monitor LIVEACTION-FLOWMONITOR input
    ip flow monitor LIVEACTION-FLOWMONITOR output
    exit
    interface GigabitEthernet1/0/6
    ip flow monitor LIVEACTION-FLOWMONITOR input
    ip flow monitor LIVEACTION-FLOWMONITOR output
    exit
    interface GigabitEthernet1/0/5
    ip flow monitor LIVEACTION-FLOWMONITOR input
    ip flow monitor LIVEACTION-FLOWMONITOR output
    exit
    interface GigabitEthernet1/0/23
    ip flow monitor LIVEACTION-FLOWMONITOR input
    ip flow monitor LIVEACTION-FLOWMONITOR output
    exit
    interface GigabitEthernet1/0/24
    ip flow monitor LIVEACTION-FLOWMONITOR input
    ip flow monitor LIVEACTION-FLOWMONITOR output

    Welcome to the Arch forums.  That was an amazing first post.  It is refreshing to see a new forum member actually post with as much detail as possible in order to explain the situation.  Too often we get people saying things like "I can't get to the internet... why?" as the extent of their post.  So thanks.
    So I am curious about what the dhcpcd is trying to do.  It seems to be trying to soliciting for a ipv6 address, but mentions nothing about in ipv4 address.  It is not unfortunately not entirely uncommon for dhcpcd to time out waiting for an ipv6 address that never comes.  So are you using ipv6?  Do you expect an ipv6 address?  I noticed that when you tried to ping the google DNS server, you used their ipv4 address (8.8.8.8).  So I am thinking that means you are actually using ipv4.
    I wonder if you might be able to poll for just an ipv4 address with dhcpcd.  Just run it with -4 and it should disable the ipv6 stuff.  You might also want to try dhclient and see what kind of output it gives you.  If you are definitely not using ipv6, and it is not offered in your area, you might want to disable it.  There are instructions in the wiki on how to do this... but you might want to wait until you establish the issue before doing things like that.

  • Mars with Netflow on Interface VRF (on Router)

    Mars is collecting Netflow information from Interface VRF on Router, my question is that whether Mars will see the traffic inside of the VRF or not, or it will see only netflow traffic on Global routing (core MPLS devices).
    This router is PE, and connected to CE (Customer's device).
    interface GigabitEthernet5/2
    ip vrf forwarding ktb
    ip address 10.0.1.210 255.255.255.252
    ip flow ingress
    ip flow-export version 5
    ip flow-export destination 10.1.50.103 2055

    Refer to the document Top Issues for the Cisco Security Monitoring, Analysis, and Response System for more information
    http://www.cisco.com/en/US/products/ps6241/prod_troubleshooting_guide09186a008062f36e.html

  • Netflow analysis tool

    Hi,
    what is the best available tool for netflow monitoring and specially for troubleshooting issues using flow analysis? I am looking for something that works well on small network of 200 devices. 
    Thanks

    Easy enough to request a quote from both companies but from what I've seen, PRTG will be less cost. Its Netflow capability is simple but then it also does lots of other things - querying and graphing anything your can get with SNMP.
    Scrutinizer is a purpose built tool for flow analysis. It costs a bit more but gives you a lot more functionality if flow analysis is what you need to do. It won't also serve as your general purpose network management tool however. PRTG can do that.
    Both tools have trial downloads to try before you buy.

  • Netflow on 6509 in Native Mode from Vlan Interface

    I'm trying to get a 6509-E, running Cisco IOS Software, s72033_rp Software (s72033_rp-IPSERVICES_WAN-M), Version 12.
    2(33)SXI9, RELEASE SOFTWARE (fc2), to send netflow traffic from a vlan interface to a Solarwinds server.
    The server is not seeing all the vlan traffic, but does see all the traffic on the layer 2 ports (not netflow).
    I've seen that a command, ip flow ingress layer2-switched vlan, needs to be enabled, but the OS I have does not support that command.
    Or could it be that MLS is not configured except for a couple commands:
    mls netflow interface
    mls cef error action reset 
    netflow setup:
    Flow export v5 is enabled for main cache
      Export source and destination details :
      VRF ID : Default
        Source(1)       10.31.101.1 (Vlan52)
        Destination(1)  10.30.2.196 (2055)
      Version 5 flow records
      14927339 flows exported in 615072 udp datagrams
      0 flows failed due to lack of export packet
      0 export packets were sent up to process level
      0 export packets were dropped due to no fib
      0 export packets were dropped due to adjacency issues
      0 export packets were dropped due to fragmentation failures
      0 export packets were dropped due to encapsulation fixup failures
      0 export packets were dropped enqueuing for the RP
      0 export packets were dropped due to IPC rate limiting
      0 export packets were dropped due to Card not being able to export  
    interface:
    interface Vlan52
     description AN.VDI.stu
     ip address 10.31.101.1 255.255.255.0
     ip helper-address 10.31.149.200
     no ip redirects
     ip flow ingress
     ip flow egress
     ip pim neighbor-filter 98
     ip pim sparse-dense-mode
     ip cgmp

    Enabling MLS was the fix.
    mls netflow interface
    mls flow ip interface-full
    mls nde sender version 5
    mls cef error action reset   

  • NetFlow Collector - Java heap space Error

    Hello,
    I have setup NetFlow colector v6 to receive flows from 3 devices, but today, 4 days after i have started the collector, i receive the folowing error and i'm unable to generate reports anymore:
    [2009-01-08 11:13:59 EET] ERROR com.cisco.nfc.report.ReportBuilder - An unexpected error occurred.
    java.lang.OutOfMemoryError: Java heap space
    I searched on net and it seems that i have to set higher heap space memory for java. Does anybody know how to rezolv this issue on Red Hat?
    Red Hat Enterprise Linux ES release 4 (Nahant Update 5)

    It seem like that the JVM has run out of all the memory that has been allocated to it. You can change the amount of memory allocated for use by your JVM using the -Xms and -Xmx command line parameters.

  • Rapid pvst issues

    Hi,
    I'm working for a company that has 2x 6500 chasis switches in the main building as Core switches (CORE1 and CORE2). There are 3 other buildings that house employees (Building 2 and Building 3) and a DR site. The "Core" switches at these other buildings are 3750 switches (stacks of 2). The buildings are connected with 1Gb fibre (MM) leased lines in a square:
    Since a few days we are seeing alot of spanning tree recalculations on the Core switches of Building 2 and 3 which causes alot of network issues for the people in those buildings. More precisely the Gi1/0/1 interface on both core switches of those buildings (see red crosses in picture) are constantly displaying these messages:
    Feb  3 10:25:31 Building2-CORE 801113: 690303: Feb  3 10:24:20.544 cet: RSTP(750): Gi1/0/1 rcvd info expired
    Feb  3 10:25:31 Building2-CORE 801114: 690304: Feb  3 10:24:20.544 cet: %SPANTREE-2-LOOPGUARD_BLOCK: Loop guard blocking port GigabitEthernet1/0/1 on VLAN0750.
    Feb  3 10:25:32 Building2-CORE 801115: 690305: Feb  3 10:24:20.544 cet: RSTP(750): updt roles, information on root port Gi1/0/1 expired
    Feb  3 10:25:32 Building2-CORE 801116: 690306: Feb  3 10:24:20.544 cet: RSTP(750): we become the root bridge
    Feb  3 10:25:32 Building2-CORE 801117: 690307: Feb  3 10:24:20.552 cet: RSTP(750): updt roles, received superior bpdu on St1
    Feb  3 10:25:32 Building2-CORE 801118: 690308: Feb  3 10:24:20.552 cet: RSTP(750): St1 is now root port
    Feb  3 10:25:32 Building2-CORE 801119: 690309: Feb  3 10:24:20.552 cet: RSTP(750): synced St1
    Feb  3 10:25:32 Building2-CORE 801120: 690310: Feb  3 10:24:20.561 cet: RSTP(750): transmitting an agreement on St1 as a response to a proposal
    Feb  3 10:26:21 Building2-CORE 801193: 690383: Feb  3 10:25:10.910 cet: %SPANTREE-2-LOOPGUARD_UNBLOCK: Loop guard unblocking port GigabitEthernet1/0/1 on VLAN0750.
    Feb  3 10:26:21 Building2-CORE 801194: 690384: Feb  3 10:25:10.910 cet: RSTP(750): initializing port Gi1/0/1
    Feb  3 10:26:21 Building2-CORE 801195: 690385: Feb  3 10:25:10.910 cet: RSTP(750): Gi1/0/1 is now designated
    Feb  3 10:26:21 Building2-CORE 801196: 690386: Feb  3 10:25:10.910 cet: RSTP(750): updt roles, received superior bpdu on Gi1/0/1
    Feb  3 10:26:21 Building2-CORE 801197: 690387: Feb  3 10:25:10.910 cet: RSTP(750): Gi1/0/1 is now root port
    Feb  3 10:26:21 Building2-CORE 801198: 690388: Feb  3 10:25:10.910 cet: RSTP(750): St1 blocked by re-root
    Feb  3 10:26:21 Building2-CORE 801199: 690389: Feb  3 10:25:10.910 cet: RSTP(750): St1 is now designated
    Feb  3 10:26:21 Building2-CORE 801209: 690399: Feb  3 10:25:10.919 cet: RSTP(750): transmitting a proposal on St1
    Feb  3 10:26:21 Building2-CORE 801211: 690401: Feb  3 10:25:10.927 cet: RSTP(750): synced Gi1/0/1
    Feb  3 10:26:22 Building2-CORE 801212: 690402: Feb  3 10:25:10.927 cet: RSTP(750): received an agreement on St1
    And less than a minute later the same again. This is happening with all VLANs. There's about 125 VLANs and all go over the square.
    From what I understand this means BPDU packts are not received in time (2 seconds) and spanning tree starts recalculation. We already asked the provider of the leased lines to test them but they claim nothing is wrong with them. It"s also a bit weird that we are seeing this on 2 different places (physically different locations and lines).
    CPU usage looks normal (around 14%) on all switches in this square. Since it's happening on 2 locations I don't think a faulty cable or SFP is causing this.
    Any ideas from you guys?
    Regards

    Hi,
    All links between the buildings are configured as trunks indeed with no VLAN restrictions (all VLANs allowed).
    Here is the extract of the command on all 5 switches/stacks:
    MAIN-CORE1#sh spanning-tree vlan 750
    VLAN0750
      Spanning tree enabled protocol rstp
      Root ID    Priority    8192
                 Address     001c.0edc.eaee
                 This bridge is the root
                 Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
      Bridge ID  Priority    8192
                 Address     001c.0edc.eaee
                 Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
                 Aging Time 300
    Interface           Role Sts Cost      Prio.Nbr Type
    Gi1/3               Desg FWD 4         128.3    P2p
    Gi1/4               Desg FWD 4         128.4    P2p
    Gi1/5               Desg FWD 4         128.5    P2p
    Gi1/6               Desg FWD 4         128.6    P2p
    Gi1/7               Desg FWD 4         128.7    P2p
    Gi2/22              Desg FWD 4         128.150  P2p
    Gi2/23              Desg FWD 4         128.151  P2p
    Po10                Desg FWD 3         128.1666 P2p
    Interface           Role Sts Cost      Prio.Nbr Type
    Po11                Desg FWD 3         128.1667 P2p
    MAIN-CORE2#sh spanning-tree vlan 750
    VLAN0750
      Spanning tree enabled protocol rstp
      Root ID    Priority    8192
                 Address     001c.0edc.eaee
                 Cost        3
                 Port        1666 (Port-channel10)
                 Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
      Bridge ID  Priority    16384
                 Address     001c.0edc.daee
                 Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
                 Aging Time 300
    Interface           Role Sts Cost      Prio.Nbr Type
    Gi1/3               Desg FWD 4         128.3    P2p
    Gi1/4               Desg FWD 4         128.4    P2p
    Gi1/5               Desg FWD 4         128.5    P2p
    Gi1/6               Desg FWD 4         128.6    P2p
    Gi1/9               Desg FWD 4         128.9    P2p
    Po10                Root FWD 3         128.1666 P2p
    Po21                Desg FWD 4         128.1667 P2p
    Building2-CORE1#show spanning-tree vlan 750
    VLAN0750
      Spanning tree enabled protocol rstp
      Root ID    Priority    8192
                 Address     001c.0edc.eaee
                 Cost        7
                 Port        1 (GigabitEthernet1/0/1)
                 Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
      Bridge ID  Priority    33518  (priority 32768 sys-id-ext 750)
                 Address     108c.cf03.1d00
                 Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
                 Aging Time 300
    Interface        Role Sts Cost      Prio.Nbr Type
    Gi1/0/1          Root FWD 4         128.1    P2p
    St1              Desg FWD 100       128.872  P2p
    Gi2/0/1          Desg FWD 4         128.55   P2p
    Building3-CORE1#show spanning-tree vlan 750
    VLAN0750
      Spanning tree enabled protocol rstp
      Root ID    Priority    8192
                 Address     001c.0edc.eaee
                 Cost        11
                 Port        55 (GigabitEthernet2/0/1)
                 Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
      Bridge ID  Priority    33518  (priority 32768 sys-id-ext 750)
                 Address     8cb6.4fb9.7300
                 Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
                 Aging Time 300
    Interface        Role Sts Cost      Prio.Nbr Type
    Gi1/0/1          Root BKN*4         128.1    P2p *LOOP_Inc
    St1              Root FWD 100       128.872  P2p
    Gi2/0/1          Root FWD 4         128.55   P2p
    DR-01#show spanning-tree vlan 750
    VLAN0750
      Spanning tree enabled protocol rstp
      Root ID    Priority    8192
                 Address     001c.0edc.eaee
                 Cost        4
                 Port        54 (GigabitEthernet2/0/2)
                 Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
      Bridge ID  Priority    33518  (priority 32768 sys-id-ext 750)
                 Address     0013.c37a.e300
                 Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
                 Aging Time 300
    Interface        Role Sts Cost      Prio.Nbr Type
    Gi2/0/2          Root FWD 4         128.54   P2p
    Gi1/0/1          Desg FWD 4         128.1    P2p
    Fa1/0/13         Desg FWD 19        128.15   P2p
    Here is the config of MAIN-CORE1 (I removed most interfaces, VLAN interfaces and ACL's from it):
    MAIN-CORE1#sh run
    Building configuration...
    Current configuration : 44402 bytes
    upgrade fpd auto
    version 12.2
    no service pad
    service timestamps debug datetime msec localtime show-timezone
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    service sequence-numbers
    service counters max age 5
    hostname MAIN-CORE1
    boot-start-marker
    boot system flash sup-bootdisk:s72033-ipservicesk9-vz.122-33.SXI6.bin
    boot system flash sup-bootdisk:s72033-ipservicesk9-vz.122-18.SXF8.bin
    boot-end-marker
    security passwords min-length 1
    logging buffered 5000000
    no logging console
    no logging monitor
    aaa new-model
    aaa authentication login default group radius local
    aaa authentication login CONSOLE local
    aaa authentication dot1x default group radius
    aaa authorization exec default group radius local
    aaa authorization network default group radius local
    aaa session-id common
    clock timezone cet 1
    clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00
    no ip domain-lookup
    ip tftp source-interface Vlan60
    ip ftp source-interface Vlan60
    ip flow ingress layer2-switched vlan 20
    ip sla 3
    icmp-echo 172.31.99.5 source-ip X.X.X.X
    timeout 2000
    frequency 5
    ip sla schedule 3 life forever start-time now
    ip sla 4
    icmp-echo X.X.X.X source-ip X.X.X.X
    frequency 5
    ip sla schedule 4 life forever start-time now
    udld aggressive
    udld message time 7
    mls qos map cos-dscp 0 10 18 24 34 46 48 56
    mls qos
    mls netflow interface
    no mls acl tcam share-global
    mls cef error action freeze
    errdisable recovery cause udld
    errdisable recovery cause security-violation
    errdisable recovery cause psecure-violation
    errdisable recovery interval 30
    diagnostic bootup level minimal
    spanning-tree mode rapid-pvst
    spanning-tree vlan 1,21,166,168,210,842-843 priority 16384
    spanning-tree vlan 2-3,7,10,17-18,28,41,44,60,70,78,96,110,112 priority 8192
    spanning-tree vlan 121-122,125,127,140,169-170,199,209,213-214 priority 8192
    spanning-tree vlan 220-221,253-254,299,318-322,343,350,411,415 priority 8192
    spanning-tree vlan 420-421,425,430,450-451,460,500-501,540,602 priority 8192
    spanning-tree vlan 650,702,710-716,740,750,895,900-902,910,920 priority 8192
    spanning-tree vlan 940 priority 8192
    spanning-tree vlan 20 priority 9
    spanning-tree vlan 40 priority 8191
    redundancy
    main-cpu
      auto-sync running-config
    mode sso
    vlan internal allocation policy ascending
    vlan access-log ratelimit 2000
    class-map match-any test
    class-map match-all DoubleTake_map
      match access-group name DoubleTake
    policy-map DoubleTake_Pol
      class DoubleTake_map
       set ip dscp af41
    interface Port-channel10
    description connection between cores
    switchport
    switchport trunk encapsulation dot1q
    switchport mode trunk
    switchport nonegotiate
    mls qos trust cos
    interface GigabitEthernet1/3
    description Trunk To access-sw1
    switchport
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 17,20,100,112,140,209,300,740,750
    switchport mode trunk
    switchport nonegotiate
    mls qos trust cos
    interface GigabitEthernet1/4
    description Trunk To access-sw2
    switchport
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 17,20,27,100,112,209,740,750
    switchport mode trunk
    switchport nonegotiate
    interface GigabitEthernet1/5
    description Trunk To access-sw3
    switchport
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 17,20,70,112,209,221,740,750,901,902
    switchport mode trunk
    switchport nonegotiate
    interface GigabitEthernet1/6
    description Trunk To access-sw4
    switchport
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 10,17,20,28,60,70,100,112,140,209,220,300,343
    switchport trunk allowed vlan add 350,540,602,640,641,740,750,840-842,902
    switchport mode trunk
    switchport nonegotiate
    mls qos trust cos
    interface GigabitEthernet1/7
    description Trunk to DR
    switchport
    switchport trunk encapsulation dot1q
    switchport mode trunk
    switchport nonegotiate
    speed nonegotiate
    mls qos trust cos
    interface GigabitEthernet2/22
    description Link to FW1
    switchport
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 10,40,165,211-214,220,318,420,451,501,650,651
    switchport trunk allowed vlan add 750
    switchport mode trunk
    logging event link-status
    logging event spanning-tree status
    load-interval 30
    interface GigabitEthernet2/23
    description link to FW1
    switchport
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 78,121,122,124-127,221,319-322,411,415,425,430
    switchport trunk allowed vlan add 450,460,461,465,602,712,713,716,750
    switchport mode trunk
    logging event link-status
    logging event spanning-tree status
    load-interval 30
    mls qos trust dscp
    spanning-tree portfast edge
    interface GigabitEthernet5/1
    description Trunk To MAIN-CORE2
    switchport
    switchport trunk encapsulation dot1q
    switchport mode trunk
    switchport nonegotiate
    mls qos trust cos
    channel-group 10 mode on
    interface GigabitEthernet5/2
    description Trunk To MAIN-CORE2
    switchport
    switchport trunk encapsulation dot1q
    switchport mode trunk
    switchport nonegotiate
    mls qos trust cos
    channel-group 10 mode on
    ip default-gateway X.X.X.X
    ip classless
    ip forward-protocol nd
    ip forward-protocol udp discard
    ip route X.X.X.X Y.Y.Y.Y
    ip http server
    ip http access-class 39
    ip http authentication local
    no ip http secure-server
    ip flow-export source Vlan20
    ip flow-export version 9
    ip flow-export destination X.X.X.X 2000
    ip radius source-interface Vlan20
    logging trap debugging
    logging source-interface Vlan20
    logging X.X.X.X
    tftp-server sup-bootdisk:s72033-ipservicesk9-vz.122-33.SXH1.bin
    snmp-server community X
    snmp-server ifindex persist
    snmp ifmib ifindex persist
    radius-server host X.X.X.X. auth-port 1645 acct-port 1646 key 7 Y
    radius-server host X.X.X.X auth-port 1645 acct-port 1646 key 7 Y
    control-plane
    dial-peer cor custom
    line con 0
    exec-timeout 20 0
    privilege level 15
    password 7 Y
    logging synchronous
    login authentication CONSOLE
    stopbits 1
    line vty 0 4
    session-timeout 300
    access-class vty_mgmt in
    transport input telnet
    line vty 5 15
    session-timeout 60
    access-class vty_mgmt in
    transport input telnet
    exception core-file
    mac-address-table notification mac-move
    ntp clock-period 17179825
    ntp source Vlan20
    ntp master 1
    end

  • Scrutinizer monitoring issue

    Hi,
    i have installed scuritinizer ver 7.3 , but i am facing issue for monitoring the links.
    1) Routers showing green and red
    2) Traffic monitered is different than shown in sh ip accouting
    Can some body help me.

    Hello gajanangavli,
    Is this a router that is heavily used? or one that does not have much traffic? 
    The fact that the show ip flow export says that it's sending flows, and none are being dropped, says to me that the router thinks everything is ok and is exporting flows with no problem.
    The next step is to make sure you don't have an ACL or firewall issue preventing communication from the router to the Scrutinizer server on the port that you have specified in your netflow configs.
    We just released a the newest version of Flowalzyer – v2.0. It has a Netflow Listener, so that way you can confirm whether or not the flows are actually getting to Scrutinizer.
    It also has a realtime SNMP trender that you can use to confirm how much data is truly being transferred on that interface. It’s free download, so it’s a nice little tool to have.
    http://www.plixer.com/blog/webnm/free-snmp-graphing-tool-available-in-flowalyzer-v2-0/
    If you still can't find the source of the problem, feel free to call me directly at 207-324-8805 ext. 242  or send me an email - [email protected]
    Thanks,
    Raul

  • Couldnot Export Netflow entries in the PFC (hardware switched)

    Hi,
    On the Netflow Collector we are not able to see hardware switched flow entries in PFC, but software switched flow entries in MSFC can be seen. One thing which I have observed in the "show ip cache flow" output I see PFC as standby although the flow entries are there. We did the packet capture on the netflow collector but could not find hardware switched flow entries, so it seems that 6506 is not sending PFC entries.
    Following is the configuration.
    mls aging long 64
    mls aging normal 32
    mls netflow interface
    mls flow ip interface-full
    no mls flow ipv6
    mls nde sender version 5
    mls cef error action reset
    ip flow-cache entries 128000
    ip flow-cache timeout active 1
    ip flow ingress layer2-switched vlan 10,20
    ip flow-export source Loopback0
    ip flow-export version 5
    ip flow-export destination 10.19.20.31 9996
    show ip cache flow
    Displaying software-switched flow entries on the MSFC in Module 5:
    IP packet size distribution (8679322 total packets):
       1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480
       .132 .142 .325 .166 .082 .046 .019 .015 .006 .000 .001 .000 .001 .000 .013
        512  544  576 1024 1536 2048 2560 3072 3584 4096 4608
       .001 .001 .001 .005 .035 .000 .000 .000 .000 .000 .000
    IP Flow Switching Cache, 8454644 bytes
      30 active, 127970 inactive, 1523126 added
      438002488 ager polls, 0 flow alloc failures
      Active flows timeout in 1 minutes
      Inactive flows timeout in 15 seconds
    IP Sub Flow Cache, 1040712 bytes
      30 active, 31970 inactive, 1522942 added, 1522942 added to flow
      0 alloc failures, 0 force free
      1 chunk, 1 chunk added
      last clearing of statistics 2w1d
    Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)
    --------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow
    TCP-FTP          40819      0.0        10    73      0.3       0.5       3.1
    TCP-FTPD         40607      0.0         3    42      0.1       0.0       1.5
    TCP-WWW           2071      0.0        10   918      0.0       5.1     164.8
    TCP-other        39829      0.0        25   245      0.7       6.6     188.0
    UDP-DNS           1579      0.0         3    92      0.0       6.7     293.7
    UDP-NTP           3309      0.0         2    94      0.0     105.4     195.0
    UDP-TFTP             2      0.0        10    52      0.0     169.3     131.2
    UDP-Frag             5      0.0         1    57      0.0       1.0     299.5
    UDP-other       576228      0.4         2   197      1.1      13.8     285.8
    ICMP             55727      0.0         4   591      0.1     161.5     137.9
    GRE              28899      0.0        45    28      0.9     285.4       1.0
    IP-other        111838      0.0        34   129      2.9     292.4       8.0
    Total:          900913      0.6         9   150      6.5      65.0     202.5
    SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts
    Gi5/2         172.16.148.254  Tu2           10.191.32.12    2F 0000 0000     2
    Gi5/2         172.16.195.254  Tu4           10.191.32.14    2F 0000 0000     2
    Gi5/2         10.191.32.62    Vl10          10.191.32.12    2F 0000 0000     4
    Displaying hardware-switched flow entries in the PFC (Standby) Module 5:
    SrcIf            SrcIPaddress     DstIf            DstIPaddress    Pr SrcP DstP  Pkts
    Tu5              10.191.8.89      Vl10             10.190.102.240  2F 0000 0000  4780
    Tu5              10.191.8.89      Vl10             10.190.103.89   2F 0000 0000  6218
    Gi5/2            10.122.3.35      Tu4              172.16.33.97    06 008B 105F     1
    Tu5              10.191.8.89      Vl10             10.190.102.123  2F 0000 0000    73
    Tu5              10.124.24.45     Tu2              172.16.148.17   06 0E9F 008B     2
    Tu5              10.124.114.221   Gi5/2            10.129.1.89     06 4E21 04D8   450
    Gi5/2            10.70.72.8       Tu6              172.16.105.242  06 0050 0B3E     5
    show module
    Mod Ports Card Type                              Model             
      5    9  Supervisor Engine 32 8GE (Active)      WS-SUP32-GE-3B    
      6    9  Supervisor Engine 32 8GE (Hot)         WS-SUP32-GE-3B  
    Mod MAC addresses                       Hw    Fw           Sw           Status
      5  001f.6cfe.aba2 to 001f.6cfe.abad   4.6   12.2(18r)SX2 12.2(33)SXH3 Ok
      6  001f.9e9a.ae4c to 001f.9e9a.ae57   4.6   12.2(18r)SX2 12.2(33)SXH3 Ok
    Mod  Sub-Module                  Model              Serial       Hw     Status
    5  Policy Feature Card 3       WS-F6K-PFC3B               2.4    Ok
      5  Cat6k MSFC 2A daughterboard WS-F6K-MSFC2A    4.0    Ok
      6  Policy Feature Card 3       WS-F6K-PFC3B               2.4    Ok
      6  Cat6k MSFC 2A daughterboard WS-F6K-MSFC2A     4.0    Ok
    I have gone through following documents but could not find any clue on why PFC entries are not exported.
    http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/netflow.html#wp1080827
    http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_example09186a0080721701.shtml
    Regards,
    Akhtar

    Hi,
    Just to further update this case with troubleshooting results.
    1. I am able to recieve all flows sent from NDE 6506 Switch on NF Collector-A.
    2. Only few flow are being received on NF CollectorB.
    3. When comparing packet captured on NF Collector-A and B, I see only small size UDP packets(~350bytes) on NF Collector B, whereas on NF A I see packets more than 800 bytes...
    This issue is surely pertaining to GRE+IPSEC. I have checked the forums and found issue of ""Self Generated Netflow packets not encrypted"" but my issue not seems to relevant b/c NDE 6506 which is exporting Netflow is not encrypting.......
    Any thoughts !!
    NDE 6506 Switch)----(CORE-6509)----(DC-WAN-1-6506)-----GRE+IPSEC------(DC-WAN-2-6506)------(CORE-6509)-----(DC-AGG)----(DC-ACC)---NF CollectorB
                                          |
                                          |
                                    NF Collector-A

  • Netflow Report

    I am using Netflow collector 6.0 with linux os. I am not able to get source add / Destination Add in the report.
    Could you please help me out.

    Hi. I want to help you with this issue, but I think I need more information. Could you please tell me if you are receiving any error messages when pulling this report? Could you please upload a screenshot here of what you do see, and describe how that differs from what you expect?
    Thanks,
    -Joe

  • NBAR, Netflow, QoS Policing, 6500s, IOS 12.1(26)E7, and MARS

    Hello. I'm having trouble seeing the forest OR the trees, and I'd appreciate some help from someone who has a better field view than myself. We're upgrading our internet connection to 200MB and management is wanting to upgrade our Packet Shaper to meet the new bandwidth. (The Packet Shaper shows top talkers, top protocols, and rate limits protocols or users.) I'm trying to make the argument that we can do this w/ existing tools (nbar, netflow, QoS policing, and MARS), at the same time I'm trying to make the argument that we need to have our supervisors (currently SUP2 MSFC2) on a 3-4 year upgrade cycle.
    To get to the 12.2 IOS, I'd require a memory or sup upgrade. What I am hoping for is someone who has gone down this road who knows what I'm lacking in 12.1 code, or if in fact I can do it all here.
    While it is self-evident to most in IT why we need to regularly upgrade equipment, I'm having difficulty making this argument to management with hard facts. I'm guessing they'd still be running Windows for Workgroups to save money...but that's another story.
    My plan is to use Netflow and MARS to track top users and top protocols. It appears that I lose some mgt functionality w/ MARS in conjunction w/ IOS 12.1, but I am currently unclear if I lose any tracking capability. (MARS is new to us and awaiting install.)
    Then, I hope to use NBAR to identify all the latest P2P traffic and police it appropriately w/ QoS tools.
    Does my thinking sound solid? Will I be able to pull this off w/ 12.1? If not, what do I need that I lack in 12.1?
    Thank you for your time,
    Joshua

    Hi,
    First of all - you need to be clear that although MARS uses netflow data, it uses it for the purpose of identifying security issues. If you want to use netflow for reporting and/or accounting purposes MARS isn't the tool you need, try one of the following freeware netflow tools:
    http://www.cisco.com/warp/public/732/Tech/nmp/netflow/partners/freeware/index.shtml
    or one of the following commercial tools:
    http://www.cisco.com/warp/public/732/Tech/nmp/netflow/partners/commercial/index.shtml
    The freeware ones are generally more difficult to set up but once running are just as good as the commercial ones.
    However, this means you need two netflow destinations - one for MARS and one for your netflow tool, and this feature is called "Netflow Multiple Export Destinations" and initially appeared at 12.1(3)T, but it seems to be VERY platform specific - for example, because we only run GD software on our 3660's we had to upgrade to 12.3(20) to get it.
    Looking at the Feature Navigator for SUP2/MSFC2 it appears that you need at least 12.2(18)SXF6 to get this feature so that might help your case.
    I'd personally keep the PacketShaper for it's reporting capability if nothing else (IOS can do the job, but not as elegantly as the PacketShaper).
    HTH - plz rate if useful.
    Andrew.

Maybe you are looking for

  • REM Reporting Point line item with operation number 9999

    Dear guru, I run MFBF with a REM Profile that post Automatic GR and Activities. I have four operation in the material routing (10,20,30,40) For the first three operations I want to confirm them with target activities I define Third Operation with ope

  • How To Split One Record  into 30 Records(Number of days in a Month)

    Hi Experts,   we are getting the montly(yearmonth) Forecast data from flat file we need to generate the report which shows the daily Forecast data, For example for the month of June Forecast we have  150EA. Flat file data is like this   0calday    Qt

  • Audigy 2 ZS and Inspire T7900 Serious Problems!

    Hey Guys I'am a guy from germany and I have serious problems with my speaker system! Following System: Windows XP Professional with SP2Creative Audigy 2 ZS SoundcardCreatice Inspire T7900(7.1) Speakers My Problem: No Surround!My Card is configured to

  • BOOM godsend or horror?

    I'm about in tears.  I've been trying since one o'clock to eject Boom  from my iMac and all I've succeeded in doing is lose my audio  intirely.  I connected to the "Free" app a week ago, it was great.   Today they told me my trial time was up so I gl

  • E1200 Router installation desired without modem/internet

    I purchased an E1200 wireless router with the intention of "connecting" three wireless laptops in our home (close proximity).  I do not desire internet with the connection and so didn't purchase a modem.  It will not install because I do not have it