Cisco 6500 Series Software Configuration Manual page 477

Chapter 33 Configuring NDE
•
•
The PFC uses only one flow mask for all Layer 3-switched traffic. If you change the flow mask
configuration, the entire MLS cache is purged.
NDE Versions
NDE on the PFC supports the following NDE versions to export the statistics captured on the PFC for
Layer 3-switched traffic:
•
•
Depending on the current flow mask, some fields in the flow records might not have values. When the
PFC exports cached entries, unsupported fields are filled with a zero (0).
With the WCCP Layer 2 redirect, the nexthop field and the output field might not contain accurate
Note
information for all NetFlows. Therefore, the destination interface for traffic returned from the web server
has a client interface instead of the cache interface or the ANCS interface.
The following tables list the supported NDE fields:
•
•
•
•
Table 33-1 NDE Version 5 Header Format
Bytes
0–1
2–3
4–7
8–11
12–15
16–19
20–21
21–23
78-14099-04
full—A more-specific flow mask. The PFC creates and maintains a separate cache entry for each IP
flow. A full entry includes the source IP address, destination IP address, protocol, and
protocol-specific Layer 4 port information.
full-interface—The most-specific flow mask. Adds the source VLAN SNMP ifIndex to the
information in the full flow mask. The full-interface flow mask is supported on Supervisor Engine 2
with Release 12.1(13)E and later releases.
Supervisor Engine 1 and PFC—NDE version 7
Supervisor Engine 2 and PFC2
NDE version 5 with Release 12.1(13)E and later releases
–
NDE version 7 with all releases
–
Table 33-1—Version 5 header format
Table 33-2—Version 5 flow record format
Table 33-3—Version 7 header format
Table 33-4—Version 7 flow record format
Content
version
count
SysUptime
unix_secs
unix_nsecs
flow_sequence
engine_type
engine_id
Catalyst 6500 Series Switch Cisco IOS Software Configuration Guide—Release 12.1 E
Description
Netflow export format version number
Number of flows exported in this packet (1–30)
Current time in milliseconds since router booted
Current seconds since 0000 UTC 1970
Residual nanoseconds since 0000 UTC 1970
Sequence counter of total flows seen
Type of flow switching engine
Slot number of the flow switching engine
Understanding How NDE Works
33-3