Re: No outbound traffic for any graphs (CampusIO)???

From: Dave Plonka (plonka@doit.wisc.edu)
Date: Wed Sep 27 2000 - 12:49:20 PDT

  • Next message: Claus Rugani Topke: "Question about filenames !"

    On Wed, Sep 27, 2000 at 09:43:39AM -0700, Todd Caine wrote:
    > Help,
    >
    > I am using the CampusIO.pm reporting module and am not
    > seeing any outbound traffic. Netflow is enabled on a
    > private peering point and is configured as 'version 5
    > peer-as'. I used flowdump on the flows.current file and saw
    > that the only next hop addresses were our local routers
    > attached to the same SRP ring, instead of a nexthop address
    > from our bilateral peer.

    OK... What we're interested in is what the $nexthopip and $output_if
    values are for your outbound flows.

    Try this, and look for outside world destination IP addresses in the
    3rd column:

       $ flowdumper -ne 'printf("%-15.15s %2d %-15.15s\n", $nexthopip, $output_if, $dstip)' flows.current

    What $nexthopip (1st column) and $output_if values are you seeing for
    these outbound flows?

    If the nexthops are as you say, your local routers, then you're
    probably exporting flows from the wrong router(s). See the cflowd
    configuration docs, specifically:
    http://www.caida.org/tools/measurement/cflowd/configuration/configuration-7.html
    The exporter should be at the "border" of your network.

    If your nexthops are the same as the $dstip, which I have seen in
    simple configurations with ip unnumbered interfaces using default to
    route all outbound traffic, then you must use OutputIfIndexes, as
    apparently you've tried:

    > In my CampusIO config file I was using the 'NextHops'
    > directive and had that set to the IP address taken from the
    > neighbor statement for the bilateral peer. I have recently
    > tried using the 'OutputIfIndexes' directives instead and
    > configured it with the ifIndex for the interface connected
    > to our peer.
    >
    > Any ideas why I am not getting any outbound traffic?

    f the above things don't help, check the "flowscan" list archive:

       http://net.doit.wisc.edu/~plonka/list/flowscan/archive/

    or join the "flowscan" mailing list. Instructions are here:

       http://net.doit.wisc.edu/~plonka/FlowScan/#Mailing_Lists

    and we can continue this thread there. (I cross posted this reply.)

    Dave

    -- 
    plonka@doit.wisc.edu  http://net.doit.wisc.edu/~plonka  ARS:N9HZF  Madison, WI
    --
    cflowd mailing list
    cflowd@caida.org
    



    This archive was generated by hypermail 2b29 : Wed Sep 27 2000 - 13:38:36 PDT