Hi,

I have connection scheme Cisco 6500 ---- Cisco 3925. I collec data from 6500 (RSPAN tx) and 3925 (Netflow ingress). Why Netflow values on 3925 differs from RSPAN 6500 and show interface command on 3925 (it`s same)?

Thanks.

Article Comments

Hi Miha2000

Are you comparing SNMP Traffic and Netflow data here by any chance? If not, could you provide graph screenshots so I can compare them?

Kind regards,
Stephan Linke, Tech Support Team


Feb, 2018 - Permalink

Thanks for the screenshots. Are there any filters applied to the netflow sensor?


Feb, 2018 - Permalink

?nly time filter. If you about traffic type, it`s real. There is only esp.


Feb, 2018 - Permalink

Is sampling enabled in the netflow sensor or the target device?


Feb, 2018 - Permalink

Sampling mode - off 

Device Netflow configuration:
ip flow-cache timeout inactive 10
ip flow-cache timeout active 5
ip flow-export version 9
ip flow-export destination 10.50.11.130 9991

I thought it was because of `ip virtual-reassembly in`, but now I disable it.


Feb, 2018 - Permalink

Then the device may use flow templates PRTG does not understand correctly. Please use our Netflow Tester while the Flow Sensor is paused to see what kind of flow packets the device is sending. Post a screenshot after you let that run for a while. Thanks!

Kind regards,
Stephan Linke, Tech Support Team


Feb, 2018 - Permalink