Cisco Systems 6500, EA6500 NDE Versions

33-3
Catalyst 6500 Series Switch Cisco IOS Software Configuration Guide—Release 12.1 E
78-14099-04
Chapter 33 Configuring NDE
Understanding How NDE Works
• full—A more-specific flow mask. The PFC creates and maintains a separate cache entry for each IP
flow. A full entry includes the source IP address, destination IP address, protocol, and
protocol-specific Layer 4 port information.
• full-interface—The most-specific flow mask. Adds the source VLAN SNMP ifIndex to the
information in the full flow mask. The full-interface flow mask is supported on Supervisor Engine 2
with Release 12.1(13)E and later releases.
The PFC uses only one flow mask for all Layer 3-switched traffic. If you change the flow mask
configuration, the entire MLS cache is purged.
NDE Versions
NDE on the PFC supports the following NDE versions to export the statistics captured on the PFC for
Layer 3-switched traffic:
• Supervisor Engine 1 and PFC—NDE version 7
• Supervisor Engine 2 and PFC2
– NDE version 5 with Release 12.1(13)E and later releases
– NDE version 7 with all releases
Depending on the current flow mask, some fields in the flow records might not have values. When the
PFC exports cached entries, unsupported fields are filled with a zero (0).
The following tables list the supported NDE fields:
• Table 33-1—Version 5 header format
• Table 33-2—Version 5 flow record format
• Table 33-3—Version 7 header format
• Table 33-4—Version 7 flow record format
Table 33-1 NDE Version 5 Header Format
Bytes Content Description
0–1 version Netflow export format version number
2–3 count Number of flows exported in this packet (1–30)
4–7 SysUptime Current time in milliseconds since router booted
8–11 unix_secs Current seconds since 0000 UTC 1970
12–15 unix_nsecs Residual nanoseconds since 0000 UTC 1970
16–19 flow_sequence Sequence counter of total flows seen
20–21 engine_type Type of flow switching engine
21–23 engine_id Slot number of the flow switching engine