?
Solved

netflow from Cisco 2811 not arriving at destination?

Posted on 2011-03-02
3
Medium Priority
?
1,047 Views
Last Modified: 2012-06-27
As you can see below - exported flows count is incrementing.  But in my Solar Winds netflow collector "Last Received Netflow" is saying "Never".  The incrementing counter should mean that the router is properly trying to send the netflow info - right?

c2811-1#sho ip flow export
Flow export v5 is enabled for main cache
  Export source and destination details :
  VRF ID : Default
    Source(1)       10.10.5.1 (GigabitEthernet1/0.1)
    Destination(1)  10.10.1.15 (2055)
  Version 5 flow records
  123940560 flows exported in 5169293 udp datagrams
  0 flows failed due to lack of export packet
  0 export packets were sent up to process level
  0 export packets were dropped due to no fib
  0 export packets were dropped due to adjacency issues
  0 export packets were dropped due to fragmentation failures
  0 export packets were dropped due to encapsulation fixup failures

c2811-1#sho ip flow export
Flow export v5 is enabled for main cache
  Export source and destination details :
  VRF ID : Default
    Source(1)       10.10.5.1 (GigabitEthernet1/0.1)
    Destination(1)  10.10.1.15 (2055)
  Version 5 flow records
  123941197 flows exported in 5169314 udp datagrams
  0 flows failed due to lack of export packet
  0 export packets were sent up to process level
  0 export packets were dropped due to no fib
  0 export packets were dropped due to adjacency issues
  0 export packets were dropped due to fragmentation failures
  0 export packets were dropped due to encapsulation fixup failures
0
Comment
Question by:amigan_99
  • 2
3 Comments
 
LVL 24

Accepted Solution

by:
rfc1180 earned 2000 total points
ID: 35023491
> 10.10.1.15
This is the destination, but it is not on the same broadcast domain.

Are you able to confirm ip connectivity end to end (ICMP, traceroute, etc).
Is the network in the routing table?
How is the routing tables end to end?
Are there any filters in the path that might be dropping UDP packets?
Have you ran wireshark of some sort on the Solarwinds host to see if the packets are even arriving?

Billy
0
 
LVL 1

Author Comment

by:amigan_99
ID: 35028276
If I ping from the source interface for netflow I can ping the collector - yes.  That's a good thought to look at wireshark on solar winds.  I think it's on there actually.
0
 
LVL 1

Author Closing Comment

by:amigan_99
ID: 35030056
Well the cflow data is definitely not getting there - confirmed via wireshark.  Thanks for the reminder.
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The use of stolen credentials is a hot commodity this year allowing threat actors to move laterally within the network in order to avoid breach detection.
David Varnum recently wrote up his impressions of PRTG, based on a presentation by my colleague Christian at Tech Field Day at VMworld in Barcelona. Thanks David, for your detailed and honest evaluation!
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…

578 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question