Exporter Shows Multiple Interfaces

Scrutinizer is an enterprise/business class NetFlow and sFlow analysis tool. Scrutinizer provides historical trends of the company's critical network interfaces as well as the details on:

Who: The end system causing the traffic
What: The application/protocol that is being used
When: The time frame it has been occurring for
Where: The network connection that is affected

Moderators: scottr, Moderator Team

Post Reply
bwilliam
Posts: 1
Joined: Wed Feb 25, 2015 11:44 am

Exporter Shows Multiple Interfaces

Post by bwilliam » Wed Jun 22, 2016 12:16 pm

I opened a support case, but have yet to hear a response so I thought I would hit the experts up. Recently I enabled netflow on my Cisco 6807 using the below configuration. After the exporter was detected in scrutinizer I noticed its showing all the client ports, instead of the SVI's it was applied on. Any help isolating why all interfaces are being shown will be greatly appreciated.

flow record nbar-mon
description NBAR flow monitor
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input
collect routing destination as
collect routing forwarding-status
collect routing next-hop address ipv4
collect ipv4 source prefix
collect ipv4 source mask
collect ipv4 destination mask
collect transport tcp flags
collect interface output
collect flow sampler
collect counter bytes
collect counter packets
collect timestamp sys-uptime first
collect timestamp sys-uptime last
!
!
flow record type performance-monitor performancemonitor
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
collect routing forwarding-status
collect ipv4 dscp
collect ipv4 ttl
collect ipv4 source mask
collect ipv4 destination mask
collect transport packets expected counter
collect transport packets lost counter
collect transport packets lost rate
collect transport round-trip-time
collect transport event packet-loss counter
collect transport rtp jitter mean
collect transport rtp jitter minimum
collect transport rtp jitter maximum
collect interface input
collect interface output
collect counter bytes
collect counter packets
collect timestamp interval
collect application media bytes counter
collect application media bytes rate
collect application media packets counter
collect application media packets rate
collect application media event
collect monitor event
!
!
flow exporter export-to-scrutinizer
description flexible NF v9
destination 172.18.2.18 vrf UserZone1
source Loopback2
transport udp 2055
template data timeout 60
option interface-table
option exporter-stats
!
!
flow monitor type performance-monitor performancemonitor
description performance monitor
record performancemonitor
exporter export-to-scrutinizer
!
!
flow monitor netflow-mon
description app traffic analysis
exporter export-to-scrutinizer
cache timeout active 60
record nbar-mon

interface vlan 2060
ip flow monitor netflow-mon input
service-policy type performance-monitor input performancemonitor
service-policy type performance-monitor output performancemonitor

Jeff M
Posts: 16
Joined: Tue May 12, 2015 8:10 am

Re: Exporter Shows Multiple Interfaces

Post by Jeff M » Tue Jul 05, 2016 10:27 am

Hi bwilliam

This is new behavior to Scrutinizer starting in version 16. We received quite a few requests for all interfaces to be displayed under each device rather than just the active interfaces, or interfaces with a NetFlow configuration applied to them.

If you'd like we can permanently hide the inactive interfaces with a simple SQL query joining to tables. If this is something you'd like to perform, please don't hesitate to contact us in support at 207-324-8805 x4 and we'd be more than happy to assist,

Apologies if a case was opened and you never heard back. We try to be very diligent with our support requests. I'll be investigating what happened here so that it does not happen again.

Thank you for contacting us on multiple mediums. We really do appreciate the feedback.

-Jeff

Post Reply

Who is online

Users browsing this forum: No registered users and 3 guests