This is a good question. The whole story is this one...
First of all, you're facing this bug/feature :
CSCds01865 : Delete the cef-layer entries in the ifTable
Release Note : As part of adding the BGP-POLICY-ACCOUNTING-MIB
a new layer was added to the ifTable--the cef-layer.
Integrated : 12.0(13.06)ST 12.0(12.06)S01 12.0(13.01)S 12.0(12.06)SC01
The bug was raised in order to remove this additional ifIndex. This
has been done by changing the implementation of the
BGP-POLICY-ACCOUNTING-MIB and referencing the BPA point to the
physical interface instead. It's fixed in the 'Integrated' releases
The second part of your email is due to the way NetFlow was originally
implemented, where indeed the netflow export data had the ifIndex
of the ATM main interface. It should be the sub-interface ifIndex instead.
This has been corrected since 12.0(1)T.
So the answers are
- it's the IOS
- it behaves differently in 11.x and 12.x
- it should work properly with 12.x, but you may face CSCds01865
Hope it helps,
> From email@example.com Wed Feb 21 15:35:09 2001
> Return-Path: <firstname.lastname@example.org>
> X-Authentication-Warning: ipn.caida.org: petidomo set sender to email@example.com using -f
> From: Martin_Nieuwelaar@infonet-europe.com
> To: firstname.lastname@example.org
> Subject: What ifIndex number should netflow stats appear on?
> Date: Wed, 21 Feb 2001 15:21:31 +0100
> Content-Transfer-Encoding: 7bit
> Sender: email@example.com
> Precedence: list
> Hi people,
> We have recently started collecting Netflow Exports from a 12008 GSR in our
> network. It's running IOS 12.0(12)S. It has a POS interface 5/0 with
> ifIndex 10. There is a sub interface POS5/0.500 with ifIndex number 26.
> When I enable netflow exports, I find that cflowd gathers stats from the
> router with ifIndex number 25!!! (I expected them to have ifIndex number
> 10). I looked up ifIndex number 25 using snmpwalk and I found
> POS5/0.500-cef layer. What gives? Are other poeple experiencing this too?
> This behaviour I have just mentioned differs from what I have become
> accustomed to. The other routers in the network behave as follows. These
> routers are 7500 series, running IOS 11. As an example a physical interface
> ATM4/0/0 has an ifIndex number of 16. A sub interface ATM4/0/0.211 exists
> but has no ifIndex number. Using snmpwalk I find there is an ATM4/0/0-atm
> layer (ifIndex number 40) and ATM4/0/0-aal5 layer (ifIndex number 41). The
> netflow stats that CFlowd receives all originate from ifIndex 16.
> So in summary the sub interfaces seem to be handled differently. Has anyone
> got a thought as to why there is a difference? Is it the IOS? Is that just
> how POS sub-interfaces work? Is there a document describing this? I know
> it's not specific to CFlowd, but I'm sure it's relevant to a lot of people
> Thanks in advance,
> "Buying a car because it's reliable is like marrying
> someone because they are punctual" - Jeremy Clarkson
> cflowd mailing list
-- cflowd mailing list firstname.lastname@example.org
This archive was generated by hypermail 2b29 : Wed Feb 21 2001 - 07:26:49 PST