I was working with a customer the other day and I notice that the MFSN (Missed Flow Sequence Number) LED was yellow.
For those of you exporting NetFlow from the Catalyst 6500 you might find this blog informative. After seeing the LED above, we decided to check out the export details on his Catalyst 6500:
Notice above that the MFSN counter is increasing as the Flows and datagrams increased. If your Catalyst 6500 is busy with network traffic, make sure you pay attention to the NetFlow Overflow with TCAM tables issue. In short, the 6500/7500 TCAM tables are limited to ~239K entries. When the TCAM is full, it drops flows, but the supervisor continues to forward traffic. Once this happens, the flow sequence numbers may get out of whack. The MFSN counter wasn’t increasing on any other device the collector was receiving from so, I’m pretty sure it was the switch and not Scrutinizer. I still need to investigate this more.
Any comments?Michael Patterson
Founder and CEO
For a free 30 day trial of Scrutinizer, Download Now!
Sign up for Advanced NetFlow Training™ coming to a city near you!Tags: cisco catalyst 6500, netflow overflow, TCAM tables