Guest

Preview Tool

Cisco Bug: CSCun54469 - Netflow UDP source port is wrong in sh flow exporter

Last Modified

Jul 20, 2018

Products (1)

  • Cisco Carrier Routing System

Known Affected Releases

5.1.1.BASE

Description (partial)

Symptom:
UDP source port used to export Netflow packets by the CRS or ASR9K is wrong.

For example:

RP/0/RP0/CPU0:SFR_CRS-X#sh flow exporter EXPORTER-MPLS location 0/1/cpu0
Tue Mar  4 03:09:56.470 FRANCE
Flow Exporter: EXPORTER-MPLS
Flow Exporter memory usage: 3280868
Used by flow monitors: MONITOR-MPLS

Status: Normal
Transport   UDP
Destination 1.58.32.21      (1337)      VRF default
Source      1.1.1.1         (63608) << wrong port, correct port is 30968
<snip>

Source port displayed by the sh command is wrong and suffers from endian swap:

63608 in hex > 0xF878
30968 in hex > 0x78F8

This can be confirmed with a tcpdump on the collector:
User Datagram Protocol, Src Port: 30968 (30968), Dst Port: menandmice-dns (1337)

Conditions:
Flow exporter map is configured, and on a linecard with a little-endian architecture (e.g. Intel-based).
Bug details contain sensitive information and therefore require a Cisco.com account to be viewed.

Bug Details Include

  • Full Description (including symptoms, conditions and workarounds)
  • Status
  • Severity
  • Known Fixed Releases
  • Related Community Discussions
  • Number of Related Support Cases
Bug information is viewable for customers and partners who have a service contract. Registered users can view up to 200 bugs per month without a service contract.