NetFlow on All Interfaces

Hi All,
We are using ManageEngine NetFlow Analyzer to monitor our network traffic.
We have a few VLAN interfaces on the switch where we have enabled flow-export ingress and egress. We can see traffic that is passing between the VLANs on which flow-export has been configured. However, we have on interface that is connected to remote locations. We have not enabled flow-export on this interface. The idea was that, we have enabled ingress and egress flow-export, and the remote locations connect to VLANs where flow-export is already enabled, we must get all traffic from there. But we cannot see traffic from the remote locations, but we can see traffic from inside network to remote locations.
After checking ManageEngine documentation, I see that we have to enable netflow on all interfaces to get accurate report. Can anyone let me know why this is required. We already have ingress and egress flow-export, and we must be getting all traffic. Please suggest.
Thanks in advance,
Faiz

Hello Faiz,
As you probably know, NetFlow by default is only collected ingress.  The ingress flows collected on all interfaces are used to display the outbound traffic on a selected interface.  I don't know about ManageEngine but, in some NetFlow solutions, interfaces without NetFlow/IPFIX enabled will not be displayed regardless of whethor or not flows are going out of it.
Regarding ingress/egress being enabled on the same interface.  If you are using flexible NetFlow to configure the export, make sure the "flow direction" is exported in the template. The commands to export both look like this:
ip flow monitor andrew-mon input
ip flow monitor andrew-mon output
Here is a good article on enabling ingress and egress NetFlow. Realize that just because you export both ingress and egress on a single interface and you export the direction, this doesn't mean the NetFlow solution will report on the data with a behavior that you would expect. 
Ingress and egress flows are exported at the same time with only one difference "flow direction".  For this reason, this element must be included in the template to ensure that utilization isn't overstated in the flow report.  Again, this of course depends on your reporting solution.  
Many vendors can't deal with a mixture of ingress and egress flows being enabled in a seemingly random fashion on the same device.  In other words, they expect all ingress or all egress.  Only a few vendors can handle a hybrid approach.
I hope this helps. 
Jake

Similar Messages

  • Why can't GB let me use 'electric guitar' option when using Nio 2/4 interface - I have to use real instrument and miss out on all the effects. Is this normal for all interfaces?

    Why can't GB let me use 'electric guitar' option when using Nio 2/4 interface - I have to use real instrument and miss out on all the effects. Is this normal for all interfaces? The Nio reads hte guitar but GB doesn't....

    Usually effects packages are AU plugins that would have no effect on track selection. Interfaces should have no control over what kind of track you can select. I really think something else is going on her maybe something you overlooked.
    Did you choose the input channel in the track info pane. Try both channel 1 mono or channel 2 mono. Make sure the track is record enabled.

  • Set secondary DHCP on ALL interfaces.

    I wanted to post this as it's own question although it is posted already under "Ask the experts".
    We've added a secondary DHCP server to our network so that if one fails or is taken down for maintenance, we don't have a gap in service.  I need to add this new DHCP address to each interface for each controller in WCS.  I have 4 WLC's with 9 interfaces per.  That's 36 slow UI copy and pastes I'm not looking forward too.  Is there a quick way to propogate this secondary DNS to all interfaces?
    I've looked at Controller Templates and Controller Config Groups but can't seem to find my way through either to a solution to my situation.  Can you offer any advice?
    (Unrelated) Also, I can't post to this group from Firefox.  IE works fine.  Weird.

    I wanted to post this as it's own question although it is posted already under "Ask the experts".
    We've added a secondary DHCP server to our network so that if one fails or is taken down for maintenance, we don't have a gap in service.  I need to add this new DHCP address to each interface for each controller in WCS.  I have 4 WLC's with 9 interfaces per.  That's 36 slow UI copy and pastes I'm not looking forward too.  Is there a quick way to propogate this secondary DNS to all interfaces?
    I've looked at Controller Templates and Controller Config Groups but can't seem to find my way through either to a solution to my situation.  Can you offer any advice?
    (Unrelated) Also, I can't post to this group from Firefox.  IE works fine.  Weird.

  • Oracle db listening on all interfaces

    Hi,
    I have oracle xe installed on a server linux.
    Customer did some changes on the nw and now the database does not listen on all interfaces but just on 127.0.0.1:1521.
    I need Oracle listening on this port but on all available ips in this server, in other words 0.0.0.0:1521.
    I can I achieve this? I am not a db expert.
    I need to do this because I have many installed product, especially OID, and I do not know what IP is actually used to connect to the database.
    Thanks much.

    As1mov wrote:
    This is ok, the problem is that OID does not create the LDAP listner even though it seams to connect correctly to the database. Missing something here from the problem description. A LDAP listener/server is not the same an Oracle listener. Uses different tcp ports and different application protocols. Also, you mentioned Oracle XE - last time I looked this was vanilla Oracle RDBMS. No OID included.
    If you are talking about not being able to connect to an OID server - that requires oidmon and oidctl (console commands) to be used to start up the OID server (with its listener).
    Should I take care of something if I add a new ip address to the linux box?Assuming that the Oracle Listener is not configured with +(IP=FIRST)+, then no - I would expect that bouncing the listener is all that is needed for the listener to start listening on port 1521 using the +0.0.0.0+. And this can be checked by using netstat or lsof commands (the latter can be used to list the tcp ports opened by the listener process).
    If you have an error - please provide as much technical details as possible. Such as the listener.ora file, the alias entry used from tnsnames.ora, the output of a sqlplus session that attempted to use this alias to connect and failed, etc.
    I'm not clear at all as to what the problem is that you're facing with the listener and multiple interfaces/IP addresses on the same server.

  • Query all interfaces

    Hi,
    Would really appreciate some assistance in what I 'thought' is a simple task
    This is what I want to do via TCL / EEM :
    1.)  Enumerate all interfaces on the switch or just query the running config
    2.)  Query each interface config
    3.)  If the interface config doesn't contain the sting 'authentication port-control auto' - send an email with the resulting interface name etc
    I'm starting to lose my mind trying to do this 
    Thanks and regards,
    Bill

    Try this:
    event manager applet intf-auth
    event none
    action 001  cli command "enable"
    action 002  cli command "show ip int brie"
    action 003  set output "$_cli_result"
    action 004  set intfs ""
    action 005  foreach line "$output" "\n"
    action 006   string trim $line
    action 007   set line $_string_result
    action 008   string length $line
    action 009   if $_string_result eq 0
    action 010    continue
    action 011   end
    action 012   regexp "^Interface" "$line"
    action 013   if $_regexp_result eq "1"
    action 014    continue
    action 015   end
    action 016   regexp "#" "$line"
    action 017   if $_regexp_result eq "1"
    action 018    continue
    action 019   end
    action 020   regexp "^([^[:space:]]+)" "$line" match intf
    action 021   cli command "show run interface $intf"
    action 022   regexp "authentication port-control auto" "$_cli_result"
    action 023   if $_regexp_result eq "0"
    action 024    append intfs " $intf"
    action 025   end
    action 026  end
    action 027  string length "$intfs"
    action 028  if $_string_result gt "0"
    action 029   mail from "[email protected]" to "[email protected]" server "10.1.1.1" subject "Interfaces missing auth port-control" body "The following interfaces are missing 'auth port-control auto': $intfs"
    action 030  end

  • Is it possible for Nexus7000 flexible netflow monitor for interfaces with different vrf and export to one netflow analyzer?

    I have a Nexus 7000 with many vlan interfaces with multiple vrf, I would like to know if my netflow analyzer only connected to one vrf, can I use flexible netflow on the Nexus 7000 to monitor those vlan interfaces with multiple vrf and export them to my netflow analyzer, so that I can see all flow from different vrfs on my netflow analyzer?
    Thank you!

    Adriano, there is a RV042G, which supports the gig ports and a 800 mbps nat throughput. Here is the datasheet
    http://www.cisco.com/en/US/prod/collateral/routers/ps10907/ps9923/ps12262/data_sheet_c78-706724.html
    If you are using a DSL connection, the SRP527/547 models may be an alternative. These models support the RFC 1483 Bridges EOA Please note the SRP547 should be 10/100/1000. Also note the SRP521/541 are Fast Ethernet units and they do differ from the SRP527/547. The main selling point of these devices are the FXS/FXO ports. So this may also be a bit of an "unfocused" solution. But it's worth throwing the idea out there!
    Here is the admin guide;
    http://www.cisco.com/en/US/docs/voice_ip_comm/unified_communications/srp540_series/administration/srp500_AG_2567701.pdf
    Here is the datasheet;
    http://www.cisco.com/en/US/prod/collateral/voicesw/ps6790/gatecont/ps10500/data_sheet_c78-550705.pdf

  • Netflow on P interface/routers

    Hi experts,
    I am trying to enable Netflow on P routers (STM1 links, XTAG interfaces), I can just see minute ldp, snmp & ntp traffic. Is it possible to see all applications traffic on these interfaces like normal IP interfaces?
    More ever can someone help how to monitor the link utilization on these interfaces? I tried to use few snmp based tools but no success.
    Regards,

    Check MPLS aware Netflow in the followink
    http://www.cisco.com/en/US/docs/ios/12_4/netflow/configuration/guide/onf_dmnf.html
    SNMP can be used to monitor the utilisation of the interfaces on P routers. The fact that MPLS is enabled on these interfaces does not affect the operation of MPLS.

  • List of all interfaces in the XI landscape

    Hi Experts,
    Currently my company is going through a merge project with a second company, and we want to integrate the SAP systems. This will inevitably mean more interfaces to be built. What we would like to have is a way to generate a list of all the current interfaces in the XI landscape, so we can get a good overview of what can be reused or copied.
    I know we can get a list by opening the ID and looking at the configured scenario's, but we would like to automate this. Are there any tables where the interface scenario names are stored, and where we can see which type of interface it is (IDOC / File / JDBC / ...)?
    If someone knows of a solution for this, it would be greatly appreciated. Otherwise this will remain a manual action, and as such, prone to mistakes or oversights...
    Our current XI landscape is XI 3.0, SP18.
    Thanks in advance,
    Yordy

    Hi,
    Solution is very simple: Use ABAP table SMPPREL3, this table contains all relationships (end-2-end) interface. You can use this table to know all about interface.
    Only caution is that this table also have some wild-card entries so total number of interface count can vary by 1-2%, but this happen on runtime only, this table will perfectly match your manual counting.
    Regards,
    Gourav
    <i>Reward points if it helps you</i>

  • Migrating a work repository loses the LKM selection on all interfaces

    Hi,
    I have a number of projects that I have just moved from one development environment to another. I've actually carried it out twice now and had the same error each time.
    I export the work repository from my working development environment, then after setting up all the connections/schemas in the new environment, I import the work repository through designer.
    Everything seems to import fine, all my models are there, all my projects are there, but
    1. The models no longer have the Journalising Knowledge module selected and I have to reselect it before starting any journals.
    2. All the interfaces have lost the selection of the LKM in the flow tab. I have to open each interface and select the LKM I want and then rebuild all my scenarios.
    Has anyone seen this problem? Any light you can shed?
    I had a search and haven't seen anything similar.
    Regards
    Damian

    Has anyone else had this problem? Any reason why the LKM selection gets dropped during the import?
    It is quite a hassle to fix up every interface & then regenerate scenario's after importing a repository.
    Cheers,
    Matt

  • Hi all,Interface vs Abstract class

    Hi, All When We are going to use interface or an Abstract class,Can tell exactly
    Thanks in advance

    Interface class is used to contain methods that is to be defined by children classes. And abstract class, even though you can have all methods being abstract, but normally I would use this class for situation such as implement methods that are general enough to be used by the children classes and left others being abstract to be implemented by children classes later. I always think this relationship in a simple way:
    Abstract Class: Animal
    Interface : Leg, Tail, Hair, Feather, Head...
    Children classes: Tiger, Bird, etc.
    Thus, for class Animal class you can have methods such as:
    Abstract: canRoar, canSing, canFly, ...
    Non-abstract: isSleeping, isAlive...
    More example:
    Tiger extends Animal implements Leg, Tail, Head, Hair
    Bird extends Animal implements Leg, Feather, Head
    I could be wrong, correct me if so. Cheers.

  • Netflow command and interface

    Hi,
    I have a few simple questions regarding netflow. Would anyone please clarify them for me?
    1. I usually configured netflow with "ip route-cache flow" command. Anyway, I have seen articles mentioning "ip flow ingress" and "ip flow egress" commands. What is different exactly i.e. ip route-cache flow and ip flow ingress|egress? Which one should be used?
    2. I understand netflow needs to be configured on every interface to export completely netflow data. Is it correct?
    3. If there are 2 physical and 2 logical i.e. tunnel interfaces, how many/which interfaces should netflow be configured? Are only physical interfaces enough?
    Please let me know if I misunderstand anything.
    Thank you very much,
    Nitass

    AFAIK:
    1. "ip route-cache flow" is deprecated starting in 12.2(18)SXD. See this URL for other IOS trains: http://www.cisco.com/en/US/docs/ios/netflow/command/reference/nf_01.html#wp1049320
    2. It's generally correct, due to the unidirectional nature of NetFlow records. Otherwise, you run the risks such as only seeing one direction of a given "conversation".
    3. My understanding was NetFlow cache could only be enabled on layer-3 interfaces. However, on the catalyst 6000s (and sup720?), you can get layer-2 bridged traffic between hosts in the same VLAN, using the following config:
    ip flow ingress layer2-switched vlan
    ip flow export layer2-switched vlan
    Then, there's this recent thread that makes it sound promising that layer-2 ports could become NetFlow-enabled, though it's not clear (to me) how it works out in practice:
    https://supportforums.cisco.com/message/678612#678612
    So YMMV. The best bet is to actually attempt configuring it. Odds are the physical interfaces won't accept the "ip route-cache flow" or "ip flow ingress/egress" config.

  • I need to increase the sizes of all interfaces due to disability, how do I do it?

    I've spent ages looking but haven't found an option to increase all the user interface text sizes, icons etc. 

    Apart from mooblie's suggestion, another approach is to go to System Preferences, click on Accessibility, and then enable and configure the zoom options.
    In some cases you cannot simply reduce the resolution as per mooblie's suggestion as some applications will onlu run with a minimum size resolution for example Apple's Workgroup Manager tool for use with their server will not run at lower resolutions. The zoom option does not suffer this problem.

  • NetFlow sends only interface-table, no templates, no flows

    Hi,
    configured NetFlow on a 3750-X with Network Module,
    but it generates only interface-tables, no templates or flows.
    Here my Config:
    flow record Ingress
     match datalink source-vlan-id
     match datalink dot1q priority
     match datalink mac source-address
     match datalink mac destination-address
     match ipv4 version
     match ipv4 tos
     match ipv4 ttl
     match ipv4 protocol
     match ipv4 source address
     match ipv4 destination address
     match transport source-port
     match transport destination-port
     match interface input physical snmp
     collect interface output snmp
     collect counter flows
     collect counter bytes
     collect counter packets
     collect timestamp sys-uptime first
     collect timestamp sys-uptime last
    flow record Egress
     match datalink destination-vlan-id
     match datalink dot1q priority
     match datalink mac source-address
     match datalink mac destination-address
     match ipv4 version
     match ipv4 tos
     match ipv4 ttl
     match ipv4 protocol
     match ipv4 source address
     match ipv4 destination address
     match transport source-port
     match transport destination-port
     match interface output physical snmp
     collect interface input snmp
     collect counter flows
     collect counter bytes
     collect counter packets
     collect timestamp sys-uptime first
     collect timestamp sys-uptime last
    flow exporter export-to-Paessler
     description PRTG Network Monitor - NetFLow
     destination 10.10.10.27
     source Vlan5
     transport udp 9991
     template data timeout 60
     option interface-table timeout 60
    flow monitor FlowMon_Ingress
     record Ingress
     exporter export-to-Paessler
     cache timeout active 60
    flow monitor FlowMon_Egress
     record Egress
     exporter export-to-Paessler
     cache timeout active 60
    interface Vlan91
     ip flow monitor FlowMon_Ingress input
     ip flow monitor FlowMon_Egress output
    sh switch service-modules
    Switch/Stack supports service module CPU version: 03.00.65
                              Temperature                     CPU
    Switch#  H/W Status       (CPU/FPGA)      CPU Link      Version
     2       OK               58C/66C         connected     03.00.65

    Hello,
    I do not have English version( I do not want log to US language I am lazy:) This is my translation:) Responsibility Order Management->Setup->Orders->Holds find you hold and look at Authorization. MAybe your pck has error because this.
    Regards,
    Luko

  • ISCSI on all interfaces

    Is it possible to disable iSCSI from talking on certain interfaces?  I want a management interface with no iSCSI reachable on that NIC. 

    Hello lantech
    Unfortunately there is not an option in the Lifeline firmware to disable iSCSI traffic on a specific NIC.
    I recommend setting the 'Management interface' NIC to a different subnet and/or vlan that is designated for device management.  This should prevent other local initiator clients to detect the management nic as a iscsi option.
    Really iSCSI traffic should be segmented from all other network uses for best I/O performance with the LUNs.
    LenovoEMC Contact Information is region specific. Please select the correct link then access the Contact Us at the top right:
    US and Canada: https://lenovo-na-en.custhelp.com/
    Latin America and Mexico: https://lenovo-la-es.custhelp.com/
    EU: https://lenovo-eu-en.custhelp.com/
    India/Asia Pacific: https://lenovo-ap-en.custhelp.com/
    http://support.lenovoemc.com/

  • Netflow with tunnel interfaces

    Hi I have a customer who is using tunnel interfaces with IPSEC on their WAN. They are collecting Netflow stats and exporting them to a server.Under the tunnel interface I have specified the bandwidth to be 1000.When I did not specify the bandwidth the tunnel speed came up on the management software as being 9kb. This was obviously not a true reflection when observing the data. The far end remote office is terminating via dsl and my question is should I specify the bandwidth under the tunnel interface to be closer to the dsl connection they have there ie 512k? There are many other tunnels coming from the main site and I have not configured Netflow on the this particular remote end.

    Hi Justin,
    If we would define bandwidth on tunnel interface it will manipulate routing decisions also and tunnel recursiuon issue could also occur where tunnel would see that the best way to reach teh destination is via tunnel itself. Beside taht the actual bandwidth used by the tunnel is based on the physical interface associated with it.

Maybe you are looking for