Catalyst 6500 and Missed Flows

Posted in NetFlow on April 8th, 2010 by mike@plixer.com
catalyst-6500-and-missed-flows
Buffer

I was working with a customer the other day and I notice that the MFSN (Missed Flow Sequence Number) LED was yellow.

 

For those of you exporting NetFlow from the Catalyst 6500 you might find this blog informative. After seeing the LED above, we decided to check out the export details on his Catalyst 6500:


 

Notice above that the MFSN counter is increasing as the Flows and datagrams increased. If your Catalyst 6500 is busy with network traffic, make sure you pay attention to the NetFlow Overflow with TCAM tables issue.  In short, the 6500/7500 TCAM tables are limited to ~239K entries.  When the TCAM is full, it drops flows, but the supervisor continues to forward traffic.  Once this happens, the flow sequence numbers may get out of whack.  The MFSN counter wasn’t increasing on any other device the collector was receiving from so, I’m pretty sure it was the switch and not Scrutinizer.   I still need to investigate this more. 

Any comments?

Michael Patterson
Scrutinizer Product Manager
Click to download Scrutinizer now!
Join NetFlow Developments on Linkedin.com

Tags: , , ,

This entry was posted on Thursday, April 8th, 2010 at 3:45 pm and is filed under NetFlow. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

6 Responses to “Catalyst 6500 and Missed Flows”

  1. Adam Powers Says:
    April 8th, 2010 at 5:13 pm

    Was the tcam full? They should get a message in the log letting you know.

    3K fps doesn’t seem like all that much for a 268k cache cat6k.

    We’ve seen issues with sequence numbers resetting periodically which leads to weirdness in sequence # analysis.

  2. William Powley Says:
    April 13th, 2010 at 8:57 am

    Mike,

    Thanks for sharing this, it’s very good information and I’ll be sure to keep my eyes peeled for this behavior.

    Two questions though. The view you are showing with the graphs, is that a custom view in “My Views”, or is that just within the Admin tab under all the other graphs? I found my info in the later location.

    Also, if you know of any, could you add a few links to other perfomance related articles that might also help? I often remember one article or another and find my way back to others I had forgotten by using the referenced links within an article.

    Thanks again, and keep up the great work!

    William

  3. Mike Patterson Says:
    April 13th, 2010 at 9:50 am

    Hello William,

    In the Status tab, click on the verson (v9, v5, etc.). It is the gray column next to the device name.

    Other performance blogs include:

    Cisco NetFlow NBAR Impacts Router Performance
    http://www.plixer.com/blog/netflow/cisco-netflow-nbar-impacts-router-performance/

    NetFlow issues: Catalyst 6513 TCAM Tables
    http://www.plixer.com/blog/netflow/netflow-issues-catalyst-6513-tcam-tables/

    Over 440 NetFlow exporting routers
    http://www.plixer.com/blog/netflow/over-440-netflow-exporting-routers/

    Unprecedented NetFlow and sFlow Archiving
    http://www.plixer.com/blog/scrutinizer/unprecedented-netflow-and-sflow-archiving/

    I hope the above helps.

    Sincerely,

    Mike

  4. Mike Patterson Says:
    April 16th, 2010 at 8:50 am

    Thanks Adam.

  5. Azher Says:
    May 4th, 2011 at 4:42 pm

    Hello,

    Do you have ipv6 configuration samples for 6500 using SXI code release ?

    Thanks
    -Azher

  6. mike@plixer.com Says:
    May 5th, 2011 at 8:46 am

    Sorry, I’m not familiar with this.

Leave a Reply