Specifications

5-4
Catalyst 6500 Series Switch and Cisco 7600 Series Router Network Analysis Module Installation and Configuration Note
78-16413-01
Chapter 5 Troubleshooting the Network Analysis Module
Netflow Data Export
Explanation When creating a NetFlow data source from the Setup > Data Sources > NetFlow >
Custom Data Sources screen, only the local device’s address appears in the drop down box.
Recommended Action A device is created in the Setup > Data Sources > NetFlow > Devices screen.
After adding a device from this screen, a default NetFlow data source for the device appears in the
Setup > Data Sources > Netflow > Custom Data Sources screen. Now, the drop down box displays
the device address included in the list.
Explanation When creating a NetFlow data source, no available interfaces list is displayed.
To make sure that the community string is correct, follow these steps:
Step 1 Go to the Setup > Data Sources > NetFlow > Devices menu.
Step 2 Click on the radio button of the device to display interfaces information.
Step 3 Click Test.
A popup window appears displaying the status of the device. If there is an error in this window, the
community string may not be correct. Correct the community string by selecting the device, click
Edit, and provide the correct community string. Also, ensure that the remote device accepts SNMP
connections.
Explanation The Monitor > Conversations page has the source column as 0.0.0.0 for all entries. This
problem occurs when the NDE device flow mask to set to destination.
If using Cisco IOS software to set the flow mask to full, interface-destination-source, or
interface-full, enter this command:
Router(config)# mls flow ip "full"||"interface-destination-source"||"interface-full"
If using Catalyst operating system software to set the flow mask to full, interface-destination-source,
or interface-full, enter this command:
Console(enable)# set mls flow "destination-source" || "full"
Note The NAM supports NDE versions 1, 5, 6, 7, 8, source-prefix, destination-prefix, prefix, and
protocol-port aggregations.
NDE Flow Records Interfaces
Explanation An NDE packet has multiple NDE flow records. Each flow record has fields of flow
input SNMP if-index and flow output SNMP if-index. The information may not be available due to
an unsupported NDE feature of the Cisco IOS or Catalyst operating system version, or
misconfiguration of the NDE flow masks.
Figure 5-1 and Figure 5-2 show the network configuration for this situation, and Table 5-1 and
Table 5-2 show the reporting flow records.