Specifications

5-2
Catalyst 6500 Series Switch and Cisco 7600 Series Router Network Analysis Module Installation and Configuration Note
78-16413-01
Chapter 5 Troubleshooting the Network Analysis Module
Netflow Data Export
Catalyst Operating System:
For the PFC, use the following commands to specify the aging time:
Router(enable) set mls agingtime [long-duration | fast | ip]
To set the aging time for flows that are long active, use the long-duration keyword.
To set the aging time for flows that do not exceed the packet threshold, use the fast keyword.
To set the aging time for IP flows, use the ip keyword.
Explanation The Monitor > Hosts and Monitor > Conversations page does not contain the data of an
active flow. This problem could be caused if the active flow is not expired yet, if the device has an
NDE filter, or if a full cache is preventing insertion of new entries. The active flow is not in the
NetFlow packets that are exporting to the NAM.
Recommended Action Check the filter long duration aging time or dropped flow packets as follows:
Verify the long duration aging time with these commands:
Router>(enable) show ip cache flow
or
Router>(enable) show mls netflow aging
or
Router>(enable) show mls
Active flows that have their active time below the long duration aging time are not expired yet, and
they have not been exported to the NAM. You can set the aging time to a lower value. Refer to the
NDE usage guidelines for the device.
Verify the dropped flow packets with these commands:
Router>(enable) show ip cache flow
or
Router>(enable) show mls netflow aging
or
Router>(enable) show mls
Flows could drop because they are not entered into the caches allowing their export to the NAM
when they are expired. The NetFlow cache might be full because of busy networks. To correct the
problem, you could increase the cache size, or adjust NDE export with the NDE flow mask or
version 8 aggregation cache. Refer to the NDE usage guidelines for the device.
Explanation There is no data for the default NetFlow data source of the device.
Recommended Action In the GUI, go to the Setup > Data Sources > NetFlow > Listening Mode page
and click on Start. Wait for a few auto refresh cycles. If the device is not displayed in the table, the
NAM is not receiving any NetFlow packets from the device. This condition could be a network
problem, or the device may not be configured correctly.