1. IMPORTANT - 11/13/2015: In light of a possible breach we have scrubbed all passwords. You will need to request a password reset through the site. Click here for more information.

nfdump and cisco, wrong counters

Discussion in 'Linux Networking' started by star1609, Oct 29, 2013.

  1. star1609

    star1609 New Member

    Oct 29, 2013
    Likes Received:
    Hi to all! I have a problem with packets/bits counting by nfcapd. I'm using cisco catalist 7600 (720 sup) ios 12.2(33)SRD4 , and nfcapd/nfsen software for collecting data. I m using such config on cisco:
    ip flow-export destination x.x.x.x 9995
    ip flow-export version 5
    mls netflow usage notify 90 120
    mls nde sender version 5
    mls sampling time-based 4096
    mls netflow usage notify 90 120

    process is starting like this:
    /usr/local/bin/nfcapd -w -D -p 9995 -u netflow -g apache -B 300000000 -S 1 -P /usr/local/nfsen/var/run/p9995.pid -z -I cuba -l /usr/local/nfsen/profiles-data/live/

    The problem is that traffic which is shown by nfdump while opening one file (5min) is 520 T and average speed 13.5 T per second , while real speed on interface is 40 gigabit per second (4x10g) and real data collected between 1-2 T . How can i fix it ?
    i have just tried to use sample rate (key -s from 1 to 8192 in nfdump) , but nothing traffic is steel at 500 t
    rdarw, Mofei and DevynCJohnson like this.

Share This Page