Catalyst 6500 and Missed Flows

Posted in NetFlow on April 8th, 2010 by mike@plixer.com
Catalyst 6500 and Missed Flows

I was working with a customer the other day and I notice that the MFSN (Missed Flow Sequence Number) LED was yellow.

For those of you exporting NetFlow from the Catalyst 6500 you might find this blog informative. After seeing the LED above, we decided to check out the export details on his Catalyst 6500:


Notice above that the MFSN counter is increasing as the Flows and datagrams increased. If your Catalyst 6500 is busy with network traffic, make sure you pay attention to the NetFlow Overflow with TCAM tables issue.  In short, the 6500/7500 TCAM tables are limited to ~239K entries.  When the TCAM is full, it drops flows, but the supervisor continues to forward traffic.  Once this happens, the flow sequence numbers may get out of whack.  The MFSN counter wasn’t increasing on any other device the collector was receiving from so, I’m pretty sure it was the switch and not Scrutinizer.   I still need to investigate this more.

Any comments?

Michael Patterson
Founder and CEO

For a free 30 day trial of Scrutinizer, Download Now!

Sign up for Advanced NetFlow Training™ coming to a city near you!

If you enjoyed this post, please consider leaving a comment or subscribing to the RSS feed to have future articles delivered to your feed reader.
Tags: , ,

8 Responses to “Catalyst 6500 and Missed Flows”

  1. Adam Powers Says:

    Was the tcam full? They should get a message in the log letting you know.

    3K fps doesn’t seem like all that much for a 268k cache cat6k.

    We’ve seen issues with sequence numbers resetting periodically which leads to weirdness in sequence # analysis.

  2. William Powley Says:

    Mike,

    Thanks for sharing this, it’s very good information and I’ll be sure to keep my eyes peeled for this behavior.

    Two questions though. The view you are showing with the graphs, is that a custom view in “My Views”, or is that just within the Admin tab under all the other graphs? I found my info in the later location.

    Also, if you know of any, could you add a few links to other perfomance related articles that might also help? I often remember one article or another and find my way back to others I had forgotten by using the referenced links within an article.

    Thanks again, and keep up the great work!

    William

  3. Mike Patterson Says:

    Hello William,

    In the Status tab, click on the verson (v9, v5, etc.). It is the gray column next to the device name.

    Other performance blogs include:

    Cisco NetFlow NBAR Impacts Router Performance
    http://www.plixer.com/blog/netflow/cisco-netflow-nbar-impacts-router-performance/

    NetFlow issues: Catalyst 6513 TCAM Tables
    http://www.plixer.com/blog/netflow/netflow-issues-catalyst-6513-tcam-tables/

    Over 440 NetFlow exporting routers
    http://www.plixer.com/blog/netflow/over-440-netflow-exporting-routers/

    Unprecedented NetFlow and sFlow Archiving
    http://www.plixer.com/blog/scrutinizer/unprecedented-netflow-and-sflow-archiving/

    I hope the above helps.

    Sincerely,

    Mike

  4. Mike Patterson Says:

    Thanks Adam.

  5. Azher Says:

    Hello,

    Do you have ipv6 configuration samples for 6500 using SXI code release ?

    Thanks
    -Azher

  6. mike@plixer.com Says:

    Sorry, I’m not familiar with this.

  7. Cisco 6509 NetFlow Problems - NetFlow & sFlow Network Monitoring - NetFlowKnights.com Says:

    [...] table size increase. When this happens your NetFlow Analyzer will flag the switch for missed flow sequence numbers. I found the following table on the Cisco website. As you can see, the sup 2T collection capacity [...]

  8. Nexus 7000 and Missed Flow Sequence Numbers - NetFlow & sFlow Network Monitoring - NetFlowKnights.com Says:

    [...] a customer who was seeing an overstated amount of missed flows associated with a Nexus 7000 in his NetFlow traffic analyzer. He was able to escalate the issue to Cisco and fixing the problem turned out to be quite simple. I [...]

Leave a Reply

You must be logged in to post a comment.