nfdump and cisco, wrong counters

Discussion in 'Linux Networking' started by star1609, Oct 29, 2013.

  1. star1609

    star1609 New Member

    Oct 29, 2013
    Likes Received:
    Hi to all! I have a problem with packets/bits counting by nfcapd. I'm using cisco catalist 7600 (720 sup) ios 12.2(33)SRD4 , and nfcapd/nfsen software for collecting data. I m using such config on cisco:
    ip flow-export destination x.x.x.x 9995
    ip flow-export version 5
    mls netflow usage notify 90 120
    mls nde sender version 5
    mls sampling time-based 4096
    mls netflow usage notify 90 120

    process is starting like this:
    /usr/local/bin/nfcapd -w -D -p 9995 -u netflow -g apache -B 300000000 -S 1 -P /usr/local/nfsen/var/run/ -z -I cuba -l /usr/local/nfsen/profiles-data/live/

    The problem is that traffic which is shown by nfdump while opening one file (5min) is 520 T and average speed 13.5 T per second , while real speed on interface is 40 gigabit per second (4x10g) and real data collected between 1-2 T . How can i fix it ?
    i have just tried to use sample rate (key -s from 1 to 8192 in nfdump) , but nothing traffic is steel at 500 t
    rdarw, Mofei and DevynCJohnson like this.

Share This Page