I was working with a customer the other day and I notice that the MFSN (Missed Flow Sequence Number) LED was yellow.

For those of you exporting NetFlow from the Catalyst 6500 you might find this blog informative. After seeing the LED above, we decided to check out the export details on his Catalyst 6500:


Notice above that the MFSN counter is increasing as the Flows and datagrams increased. If your Catalyst 6500 is busy with network traffic, make sure you pay attention to the NetFlow Overflow with TCAM tables issue.  In short, the 6500/7500 TCAM tables are limited to ~239K entries.  When the TCAM is full, it drops flows, but the supervisor continues to forward traffic.  Once this happens, the flow sequence numbers may get out of whack.  The MFSN counter wasn’t increasing on any other device the collector was receiving from so, I’m pretty sure it was the switch and not Scrutinizer.   I still need to investigate this more.

Any comments?

Mike Patterson author pic

Michael

Michael is one of the Co-founders and the former product manager for Scrutinizer. He enjoys many outdoor winter sports and often takes videos when he is snowmobiling, ice fishing or sledding with his kids. Cold weather and lots of snow make the best winters as far as he is concerned. Prior to starting Somix and Plixer, Mike worked in technical support at Cabletron Systems, acquired his Novell CNE and then moved to the training department for a few years. While in training he finished his Masters in Computer Information Systems from Southern New Hampshire University and then left technical training to pursue a new skill set in Professional Services. In 1998 he left the 'Tron' to start Somix which later became Plixer.

Related

Big Data

Sankey Flow Graph

One of the greatest benefits of NetFlow collection for traffic analysis, is we’re provided with the ability to visualize the…

Leave a Reply