GSR 12810 /w E5 Line cards. I was using flow-tools and sorting by 'octets' and it didn't show up in there (it was a 500Mbps oops) So I would've expected to see that in there.
-Drew -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Phil Mayers Sent: Friday, March 12, 2010 9:56 AM To: [email protected] Subject: Re: [c-nsp] Traffic destined to IPs that are null routed, Netflow, and you! On 12/03/10 13:23, Drew Weaver wrote: > Hi, > > I had an incident earlier this week where for "some reason" a large > amount of traffic was being sent to an IP that wasn't routed in my > network (was covered by the hold down). > > Ultimately I found the source/dest of the traffic by simply routing > all of the unused IPs to a server, and then used tcpdump. > > My question is, is it normal for this 'hold down' traffic not to show > up anywhere in Netflow? On what platform? It does show up in our netflow, on 6500/sup720. That said, the "out if" index is the ifIndex of Null0, which is NOT zero. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
