NetFlow on All Interfaces
Hi All,
We are using ManageEngine NetFlow Analyzer to monitor our network traffic.
We have a few VLAN interfaces on the switch where we have enabled flow-export ingress and egress. We can see traffic that is passing between the VLANs on which flow-export has been configured. However, we have on interface that is connected to remote locations. We have not enabled flow-export on this interface. The idea was that, we have enabled ingress and egress flow-export, and the remote locations connect to VLANs where flow-export is already enabled, we must get all traffic from there. But we cannot see traffic from the remote locations, but we can see traffic from inside network to remote locations.
After checking ManageEngine documentation, I see that we have to enable netflow on all interfaces to get accurate report. Can anyone let me know why this is required. We already have ingress and egress flow-export, and we must be getting all traffic. Please suggest.
Thanks in advance,
Faiz
Hello Faiz,
As you probably know, NetFlow by default is only collected ingress. The ingress flows collected on all interfaces are used to display the outbound traffic on a selected interface. I don't know about ManageEngine but, in some NetFlow solutions, interfaces without NetFlow/IPFIX enabled will not be displayed regardless of whethor or not flows are going out of it.
Regarding ingress/egress being enabled on the same interface. If you are using flexible NetFlow to configure the export, make sure the "flow direction" is exported in the template. The commands to export both look like this:
ip flow monitor andrew-mon input
ip flow monitor andrew-mon output
Here is a good article on enabling ingress and egress NetFlow. Realize that just because you export both ingress and egress on a single interface and you export the direction, this doesn't mean the NetFlow solution will report on the data with a behavior that you would expect.
Ingress and egress flows are exported at the same time with only one difference "flow direction". For this reason, this element must be included in the template to ensure that utilization isn't overstated in the flow report. Again, this of course depends on your reporting solution.
Many vendors can't deal with a mixture of ingress and egress flows being enabled in a seemingly random fashion on the same device. In other words, they expect all ingress or all egress. Only a few vendors can handle a hybrid approach.
I hope this helps.
Jake
Similar Messages
-
Why can't GB let me use 'electric guitar' option when using Nio 2/4 interface - I have to use real instrument and miss out on all the effects. Is this normal for all interfaces? The Nio reads hte guitar but GB doesn't....
Usually effects packages are AU plugins that would have no effect on track selection. Interfaces should have no control over what kind of track you can select. I really think something else is going on her maybe something you overlooked.
Did you choose the input channel in the track info pane. Try both channel 1 mono or channel 2 mono. Make sure the track is record enabled. -
Set secondary DHCP on ALL interfaces.
I wanted to post this as it's own question although it is posted already under "Ask the experts".
We've added a secondary DHCP server to our network so that if one fails or is taken down for maintenance, we don't have a gap in service. I need to add this new DHCP address to each interface for each controller in WCS. I have 4 WLC's with 9 interfaces per. That's 36 slow UI copy and pastes I'm not looking forward too. Is there a quick way to propogate this secondary DNS to all interfaces?
I've looked at Controller Templates and Controller Config Groups but can't seem to find my way through either to a solution to my situation. Can you offer any advice?
(Unrelated) Also, I can't post to this group from Firefox. IE works fine. Weird.I wanted to post this as it's own question although it is posted already under "Ask the experts".
We've added a secondary DHCP server to our network so that if one fails or is taken down for maintenance, we don't have a gap in service. I need to add this new DHCP address to each interface for each controller in WCS. I have 4 WLC's with 9 interfaces per. That's 36 slow UI copy and pastes I'm not looking forward too. Is there a quick way to propogate this secondary DNS to all interfaces?
I've looked at Controller Templates and Controller Config Groups but can't seem to find my way through either to a solution to my situation. Can you offer any advice?
(Unrelated) Also, I can't post to this group from Firefox. IE works fine. Weird. -
Oracle db listening on all interfaces
Hi,
I have oracle xe installed on a server linux.
Customer did some changes on the nw and now the database does not listen on all interfaces but just on 127.0.0.1:1521.
I need Oracle listening on this port but on all available ips in this server, in other words 0.0.0.0:1521.
I can I achieve this? I am not a db expert.
I need to do this because I have many installed product, especially OID, and I do not know what IP is actually used to connect to the database.
Thanks much.As1mov wrote:
This is ok, the problem is that OID does not create the LDAP listner even though it seams to connect correctly to the database. Missing something here from the problem description. A LDAP listener/server is not the same an Oracle listener. Uses different tcp ports and different application protocols. Also, you mentioned Oracle XE - last time I looked this was vanilla Oracle RDBMS. No OID included.
If you are talking about not being able to connect to an OID server - that requires oidmon and oidctl (console commands) to be used to start up the OID server (with its listener).
Should I take care of something if I add a new ip address to the linux box?Assuming that the Oracle Listener is not configured with +(IP=FIRST)+, then no - I would expect that bouncing the listener is all that is needed for the listener to start listening on port 1521 using the +0.0.0.0+. And this can be checked by using netstat or lsof commands (the latter can be used to list the tcp ports opened by the listener process).
If you have an error - please provide as much technical details as possible. Such as the listener.ora file, the alias entry used from tnsnames.ora, the output of a sqlplus session that attempted to use this alias to connect and failed, etc.
I'm not clear at all as to what the problem is that you're facing with the listener and multiple interfaces/IP addresses on the same server. -
Hi,
Would really appreciate some assistance in what I 'thought' is a simple task
This is what I want to do via TCL / EEM :
1.) Enumerate all interfaces on the switch or just query the running config
2.) Query each interface config
3.) If the interface config doesn't contain the sting 'authentication port-control auto' - send an email with the resulting interface name etc
I'm starting to lose my mind trying to do this
Thanks and regards,
BillTry this:
event manager applet intf-auth
event none
action 001 cli command "enable"
action 002 cli command "show ip int brie"
action 003 set output "$_cli_result"
action 004 set intfs ""
action 005 foreach line "$output" "\n"
action 006 string trim $line
action 007 set line $_string_result
action 008 string length $line
action 009 if $_string_result eq 0
action 010 continue
action 011 end
action 012 regexp "^Interface" "$line"
action 013 if $_regexp_result eq "1"
action 014 continue
action 015 end
action 016 regexp "#" "$line"
action 017 if $_regexp_result eq "1"
action 018 continue
action 019 end
action 020 regexp "^([^[:space:]]+)" "$line" match intf
action 021 cli command "show run interface $intf"
action 022 regexp "authentication port-control auto" "$_cli_result"
action 023 if $_regexp_result eq "0"
action 024 append intfs " $intf"
action 025 end
action 026 end
action 027 string length "$intfs"
action 028 if $_string_result gt "0"
action 029 mail from "[email protected]" to "[email protected]" server "10.1.1.1" subject "Interfaces missing auth port-control" body "The following interfaces are missing 'auth port-control auto': $intfs"
action 030 end -
I have a Nexus 7000 with many vlan interfaces with multiple vrf, I would like to know if my netflow analyzer only connected to one vrf, can I use flexible netflow on the Nexus 7000 to monitor those vlan interfaces with multiple vrf and export them to my netflow analyzer, so that I can see all flow from different vrfs on my netflow analyzer?
Thank you!Adriano, there is a RV042G, which supports the gig ports and a 800 mbps nat throughput. Here is the datasheet
http://www.cisco.com/en/US/prod/collateral/routers/ps10907/ps9923/ps12262/data_sheet_c78-706724.html
If you are using a DSL connection, the SRP527/547 models may be an alternative. These models support the RFC 1483 Bridges EOA Please note the SRP547 should be 10/100/1000. Also note the SRP521/541 are Fast Ethernet units and they do differ from the SRP527/547. The main selling point of these devices are the FXS/FXO ports. So this may also be a bit of an "unfocused" solution. But it's worth throwing the idea out there!
Here is the admin guide;
http://www.cisco.com/en/US/docs/voice_ip_comm/unified_communications/srp540_series/administration/srp500_AG_2567701.pdf
Here is the datasheet;
http://www.cisco.com/en/US/prod/collateral/voicesw/ps6790/gatecont/ps10500/data_sheet_c78-550705.pdf -
Netflow on P interface/routers
Hi experts,
I am trying to enable Netflow on P routers (STM1 links, XTAG interfaces), I can just see minute ldp, snmp & ntp traffic. Is it possible to see all applications traffic on these interfaces like normal IP interfaces?
More ever can someone help how to monitor the link utilization on these interfaces? I tried to use few snmp based tools but no success.
Regards,Check MPLS aware Netflow in the followink
http://www.cisco.com/en/US/docs/ios/12_4/netflow/configuration/guide/onf_dmnf.html
SNMP can be used to monitor the utilisation of the interfaces on P routers. The fact that MPLS is enabled on these interfaces does not affect the operation of MPLS. -
List of all interfaces in the XI landscape
Hi Experts,
Currently my company is going through a merge project with a second company, and we want to integrate the SAP systems. This will inevitably mean more interfaces to be built. What we would like to have is a way to generate a list of all the current interfaces in the XI landscape, so we can get a good overview of what can be reused or copied.
I know we can get a list by opening the ID and looking at the configured scenario's, but we would like to automate this. Are there any tables where the interface scenario names are stored, and where we can see which type of interface it is (IDOC / File / JDBC / ...)?
If someone knows of a solution for this, it would be greatly appreciated. Otherwise this will remain a manual action, and as such, prone to mistakes or oversights...
Our current XI landscape is XI 3.0, SP18.
Thanks in advance,
YordyHi,
Solution is very simple: Use ABAP table SMPPREL3, this table contains all relationships (end-2-end) interface. You can use this table to know all about interface.
Only caution is that this table also have some wild-card entries so total number of interface count can vary by 1-2%, but this happen on runtime only, this table will perfectly match your manual counting.
Regards,
Gourav
<i>Reward points if it helps you</i> -
Migrating a work repository loses the LKM selection on all interfaces
Hi,
I have a number of projects that I have just moved from one development environment to another. I've actually carried it out twice now and had the same error each time.
I export the work repository from my working development environment, then after setting up all the connections/schemas in the new environment, I import the work repository through designer.
Everything seems to import fine, all my models are there, all my projects are there, but
1. The models no longer have the Journalising Knowledge module selected and I have to reselect it before starting any journals.
2. All the interfaces have lost the selection of the LKM in the flow tab. I have to open each interface and select the LKM I want and then rebuild all my scenarios.
Has anyone seen this problem? Any light you can shed?
I had a search and haven't seen anything similar.
Regards
DamianHas anyone else had this problem? Any reason why the LKM selection gets dropped during the import?
It is quite a hassle to fix up every interface & then regenerate scenario's after importing a repository.
Cheers,
Matt -
Hi all,Interface vs Abstract class
Hi, All When We are going to use interface or an Abstract class,Can tell exactly
Thanks in advanceInterface class is used to contain methods that is to be defined by children classes. And abstract class, even though you can have all methods being abstract, but normally I would use this class for situation such as implement methods that are general enough to be used by the children classes and left others being abstract to be implemented by children classes later. I always think this relationship in a simple way:
Abstract Class: Animal
Interface : Leg, Tail, Hair, Feather, Head...
Children classes: Tiger, Bird, etc.
Thus, for class Animal class you can have methods such as:
Abstract: canRoar, canSing, canFly, ...
Non-abstract: isSleeping, isAlive...
More example:
Tiger extends Animal implements Leg, Tail, Head, Hair
Bird extends Animal implements Leg, Feather, Head
I could be wrong, correct me if so. Cheers. -
Hi,
I have a few simple questions regarding netflow. Would anyone please clarify them for me?
1. I usually configured netflow with "ip route-cache flow" command. Anyway, I have seen articles mentioning "ip flow ingress" and "ip flow egress" commands. What is different exactly i.e. ip route-cache flow and ip flow ingress|egress? Which one should be used?
2. I understand netflow needs to be configured on every interface to export completely netflow data. Is it correct?
3. If there are 2 physical and 2 logical i.e. tunnel interfaces, how many/which interfaces should netflow be configured? Are only physical interfaces enough?
Please let me know if I misunderstand anything.
Thank you very much,
NitassAFAIK:
1. "ip route-cache flow" is deprecated starting in 12.2(18)SXD. See this URL for other IOS trains: http://www.cisco.com/en/US/docs/ios/netflow/command/reference/nf_01.html#wp1049320
2. It's generally correct, due to the unidirectional nature of NetFlow records. Otherwise, you run the risks such as only seeing one direction of a given "conversation".
3. My understanding was NetFlow cache could only be enabled on layer-3 interfaces. However, on the catalyst 6000s (and sup720?), you can get layer-2 bridged traffic between hosts in the same VLAN, using the following config:
ip flow ingress layer2-switched vlan
ip flow export layer2-switched vlan
Then, there's this recent thread that makes it sound promising that layer-2 ports could become NetFlow-enabled, though it's not clear (to me) how it works out in practice:
https://supportforums.cisco.com/message/678612#678612
So YMMV. The best bet is to actually attempt configuring it. Odds are the physical interfaces won't accept the "ip route-cache flow" or "ip flow ingress/egress" config. -
I need to increase the sizes of all interfaces due to disability, how do I do it?
I've spent ages looking but haven't found an option to increase all the user interface text sizes, icons etc.
Apart from mooblie's suggestion, another approach is to go to System Preferences, click on Accessibility, and then enable and configure the zoom options.
In some cases you cannot simply reduce the resolution as per mooblie's suggestion as some applications will onlu run with a minimum size resolution for example Apple's Workgroup Manager tool for use with their server will not run at lower resolutions. The zoom option does not suffer this problem. -
NetFlow sends only interface-table, no templates, no flows
Hi,
configured NetFlow on a 3750-X with Network Module,
but it generates only interface-tables, no templates or flows.
Here my Config:
flow record Ingress
match datalink source-vlan-id
match datalink dot1q priority
match datalink mac source-address
match datalink mac destination-address
match ipv4 version
match ipv4 tos
match ipv4 ttl
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input physical snmp
collect interface output snmp
collect counter flows
collect counter bytes
collect counter packets
collect timestamp sys-uptime first
collect timestamp sys-uptime last
flow record Egress
match datalink destination-vlan-id
match datalink dot1q priority
match datalink mac source-address
match datalink mac destination-address
match ipv4 version
match ipv4 tos
match ipv4 ttl
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface output physical snmp
collect interface input snmp
collect counter flows
collect counter bytes
collect counter packets
collect timestamp sys-uptime first
collect timestamp sys-uptime last
flow exporter export-to-Paessler
description PRTG Network Monitor - NetFLow
destination 10.10.10.27
source Vlan5
transport udp 9991
template data timeout 60
option interface-table timeout 60
flow monitor FlowMon_Ingress
record Ingress
exporter export-to-Paessler
cache timeout active 60
flow monitor FlowMon_Egress
record Egress
exporter export-to-Paessler
cache timeout active 60
interface Vlan91
ip flow monitor FlowMon_Ingress input
ip flow monitor FlowMon_Egress output
sh switch service-modules
Switch/Stack supports service module CPU version: 03.00.65
Temperature CPU
Switch# H/W Status (CPU/FPGA) CPU Link Version
2 OK 58C/66C connected 03.00.65Hello,
I do not have English version( I do not want log to US language I am lazy:) This is my translation:) Responsibility Order Management->Setup->Orders->Holds find you hold and look at Authorization. MAybe your pck has error because this.
Regards,
Luko -
Is it possible to disable iSCSI from talking on certain interfaces? I want a management interface with no iSCSI reachable on that NIC.
Hello lantech
Unfortunately there is not an option in the Lifeline firmware to disable iSCSI traffic on a specific NIC.
I recommend setting the 'Management interface' NIC to a different subnet and/or vlan that is designated for device management. This should prevent other local initiator clients to detect the management nic as a iscsi option.
Really iSCSI traffic should be segmented from all other network uses for best I/O performance with the LUNs.
LenovoEMC Contact Information is region specific. Please select the correct link then access the Contact Us at the top right:
US and Canada: https://lenovo-na-en.custhelp.com/
Latin America and Mexico: https://lenovo-la-es.custhelp.com/
EU: https://lenovo-eu-en.custhelp.com/
India/Asia Pacific: https://lenovo-ap-en.custhelp.com/
http://support.lenovoemc.com/ -
Netflow with tunnel interfaces
Hi I have a customer who is using tunnel interfaces with IPSEC on their WAN. They are collecting Netflow stats and exporting them to a server.Under the tunnel interface I have specified the bandwidth to be 1000.When I did not specify the bandwidth the tunnel speed came up on the management software as being 9kb. This was obviously not a true reflection when observing the data. The far end remote office is terminating via dsl and my question is should I specify the bandwidth under the tunnel interface to be closer to the dsl connection they have there ie 512k? There are many other tunnels coming from the main site and I have not configured Netflow on the this particular remote end.
Hi Justin,
If we would define bandwidth on tunnel interface it will manipulate routing decisions also and tunnel recursiuon issue could also occur where tunnel would see that the best way to reach teh destination is via tunnel itself. Beside taht the actual bandwidth used by the tunnel is based on the physical interface associated with it.
Maybe you are looking for
-
Cannot Sign documents with stylus on windows tablet.
I bought a windows tablet with the purposes of having customers sign my worksheets electronically. In reader 11.0.10 I navigate to; fill and sign --> Place Signature --> Draw my signature. Then using a stylus or my finger to try to input the signatur
-
OVM 3.1.1 upgrade to OVM 3.2.2 summary
Storage uses local repository and OVM Manager 3.1.1 "ovm311-m" runs on OVM 3.1.1 host "ovm311", Configuration summary of OVM 3.1.1 host, [root@ovm311 ~]# dmidecode --type 1 # dmidecode 2.10 SMBIOS 2.6 present. Handle 0x0001, DMI type 1, 27 bytes Syst
-
When filling out a job application, how can you attach a reseme that stored in a app like ifiles or PDF expert?
-
Nokia 5700Xm Bluetooth problem Help Me !!!!!!
Dear frnds im using Nokia 5700XM, two days ago suddenly my phone Bt. got prob. it cant send files via Bt but it can recieve all kind of files..... plz help me Help me.
-
Why have iCal entries suddenly appeared in duplicate for every month?
My iPhones and iPad are synced with my iMac via iCloud. All devices work perfectly except iCal on my iMac shows all entries in duplicate. Adding a new entry shows up as a duplicate in the iMac but as a single entry on all other devices (which is corr