Network Management

Netflow data is unavailable on Cisco Nexus devices in NTA

Netflow data is unavailable on some Cisco Nexus devices configured to use Netflow v5. This devices can still be configured but Flexibe Netflow is still recommended for use. Data will not be processed if the values do not match the information in flow data when the device is discovered.

First published date

10/18/2018 2:46 PM

Last published date

2/22/2022 1:18 AM

Overview

Netflow data is not available on some Cisco Nexus devices that are configured to use Netflow v5. Devices can still be configured but the use of Flexible Netflow is recommended. Data is not being processed because the interface index values do not match the values in the flow data and SNMP index values stored in the database when the device is discovered. Changing the Netflow configuration on the Cisco Nexus device to use Flexible Netflow instead of Netflow v5 resolves the issue.

Product section

Netflow Traffic Analyzer

Cause

Flow data contains interface index value fields InputInt and OutputInt. These fields in Netflow v5 are 2 bytes and can only hold a maximum value of 65535. Netflow v9 on the other hand, uses 4 bytes and can hold a maximum value of 4294967295. Since v5 cannot hold the entire value, the InputInt and OutputInt fields are changed and do not match the interface index values in the database. The packets are then dropped since the values exported using v5 are changed and does not represent the matching SNMP interface index values.

This can be verified using a Wireshark capture and an SNMP walk to compare the interface index values.

Wireshark

InputIfIndex	OutputIfIndex
3096	200
3096	253
3096	253
3096	253
3096	151
3096	151

SNMP values when discovered

InterfaceIndex
151060481
151060499
151060628
151060631
151060640
151060641
151060667
151060680

Resolution

Change the Netflow configuration on the Cisco Nexus device to use Flexible Netflow instead of Netflow v5.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.