Subject: Re: Re: No data in ASPairs rrd files
From: Alberto Mantovani (amantovani@matrix.it)
Date: Fri Jun 09 2000 - 10:15:07 CDT
I have tried with:
ip flow-export version 5 peer-as
^^^^^^^
but I have the same problem.
Maybe the cause about "No data in ASPairs rrd files", is the Nexthops
values.
In CampusIO report in NextHops parameters, I have inserted the IP address of
our AS peers.
Is it correct ?
If I try the command:
$ flowdumper -ne 'print "$nexthopip\n"' flows.current |head -10000 |sort -u
It shows a different list from values inserted in CampusIO report (except
one).
(Mind that some our peers, except one, are configured with " neighbor ....
ebgp-multihop 3")
This list shows many IP address that belong to our LAN and just one IP
address of our peer (the one without ebgp-multihop configuration).
In my router I have applied the command:
ip route-cache flow
just on Ethernet Interfaces.
Thanks in advance
Alberto
> -----Original Message-----
> From: majordomo listserver [mailto:majordomo@mil.doit.wisc.edu]On Behalf
> Of Dave Plonka
> Sent: Wednesday, May 31, 2000 7:54 PM
> To: flowscan@net.doit.wisc.edu
> Subject: Re: No data in ASPairs rrd files
>
>
> On Wed, May 31, 2000 at 06:53:41PM +0200, Alberto Mantovani wrote:
> > Dave,
> >
> > I have installed FlowScan-1.002.
> > I have configured Flowscan with CampusIO report.
> > I need to create graphs about traffic between many ASPairs.
> > In the Cisco configuration I am using origin-AS.
> >
> > When Flowscan start and process flows file, it creates a rrd
> file for every
> > AS pairs.
> > In my configuration flowscan creates 5 file rrd each for every AS pairs.
> >
> > The problem is that I see data which are not equal to zero just in 1 rrd
> > file for 1 AS pair.
> > On other rrd files the data content is equal to zero (not nan).
> >
> > I have tried with SubNetIO report(because I have other local
> subnets) but
> > the result it is the same.
>
> Alberto,
>
> AS totals should be accumulated for the ASPairs you specify as long as
> the given flow has a non-zero next-hop address, and the destination
> address is not a multicast address.
>
> It is probably that you are unnecessarily using "origin-as" rather than
> "peer-as". Using "origin-as" would usually cause one to get very many
> AS numbers in your flow files - surely too many to list as ASPairs in
> "CampusIO.cf", no?
>
> The INSTALL docs for FlowScan say to use "peer-as":
>
> Configuring your Ciscos
>
> For FlowScan, I suggest that you export from your Cisco like this:
>
> ip flow-export version 5 peer-as
> [...] ^^^^^^^
>
> While I agree that FlowScan and CampusIO should still work with
> origin-as, it is not what most folks want to do, since you'd have lots
> of ASes that you talk to, and therefore lots AS2AS RRD files.
>
> To verify that you have all the proper ASPairs listed, try this command
> (which will show you all the AS numbers that appear in your flows):
>
> $ flowdumper -ne 'print "$src_as\n$dst_as\n"' flows.current
> |head -10000 |sort -u
>
> ^^^^^^^^^^^
> Of course you can vary this part depending on how big the
> flow file is...
>
> Dave
>
> --
> plonka@doit.wisc.edu http://net.doit.wisc.edu/~plonka ARS:N9HZF
> Madison, WI
>
> --
> Help mailto:majordomo@net.doit.wisc.edu and say "help" in
> message body
> Unsubscribe mailto:majordomo@net.doit.wisc.edu and say
> "unsubscribe flowscan" in message body
> Archive http://net.doit.wisc.edu/~plonka/list/flowscan/archive/
>
--
Help mailto:majordomo@net.doit.wisc.edu and say "help" in message body
Unsubscribe mailto:majordomo@net.doit.wisc.edu and say
"unsubscribe flowscan" in message body
Archive http://net.doit.wisc.edu/~plonka/list/flowscan/archive/
This archive was generated by hypermail 2b25 : Fri Jun 09 2000 - 10:18:22 CDT