Nagios Support Forum

UK-VZB-BRISTOL#sh ver
Cisco IOS Software, C3900e Software (C3900e-UNIVERSALK9-M), Version 15.4(2)T, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2014 by Cisco Systems, Inc.
Compiled Wed 26-Mar-14 16:45 by prod_rel_team

ROM: System Bootstrap, Version 15.1(1r)T5, RELEASE SOFTWARE (fc1)

UK-VZB-BRISTOL uptime is 10 weeks, 4 days, 9 hours, 49 minutes
System returned to ROM by bus error at PC 0x6E6B411 at 22:58:37 GMT Thu Jul 2 2015
System restarted at 23:00:48 GMT Thu Jul 2 2015
System image file is "flash:c3900e-universalk9-mz.SPA.154-2.T.bin"
Last reload type: Normal Reload
Last reload reason: bus error at PC 0x6E6B411



This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
[email protected].

Cisco CISCO3925-CHASSIS (revision 1.0) with C3900-SPE200/K9 with 1803264K/293888K bytes of memory.
Processor board ID FCZ173161EC
4 Gigabit Ethernet interfaces
1 Virtual Private Network (VPN) Module
DRAM configuration is 72 bits wide with parity enabled.
256K bytes of non-volatile configuration memory.
1000944K bytes of ATA System CompactFlash 0 (Read/Write)


License Info:

License UDI:

-------------------------------------------------
Device# PID SN
-------------------------------------------------
*1 C3900-SPE200/K9 FOC17281GAK



Technology Package License Information for Module:'c3900e'

------------------------------------------------------------------------
Technology Technology-package Technology-package
Current Type Next reboot
------------------------------------------------------------------------
ipbase ipbasek9 Permanent ipbasek9
security securityk9 Permanent securityk9
uc None None None
data datak9 Permanent datak9
NtwkEss None None None
CollabPro None None None

Configuration register is 0x2102

That device is flexible netflow capable - are you using flexible netflow?

If so please share the output of `show run flow record`

Thanks

UK-VZB-BRISTOL#sh run | in flow
ip flow-egress input-interface
ip flow-cache timeout active 1
ip flow ingress
ip flow egress
ip flow ingress
ip flow egress
ip flow ingress
ip flow egress
ip flow-export source GigabitEthernet0/0
ip flow-export version 9
ip flow-export destination 10.128.255.120 2055
ip flow-export destination 10.128.28.25 2055

Not flexible netflow.

That config looks OK - there is no reason we shouldn't see some traffic. Can you tcpdump -i eth0 port 2055 on the NNA box? You may need to adjust the eth0 bit to fit your environment. Is this the only device configured to send data to NNA?

Thanks. Tried to run that command but it returns 'tcpdump not found'. Yes, this is the first source we have configured.

You'll have to install tcpdump.

yum -y install tcpdump

Thanks. Installed and command run. Left it for a while (probably about an hour) then cancelled it. Doesnt appear to have captured anything. See attached.

If the tcpdump didn't capture anything, that means that the remote system is not sending data at all or it is sending to the wrong IP address or that something between them is blocking the flow traffic.
Take a look at the configuration instructions and see if the device is configured correctly.
https://assets.nagios.com/downloads/nag ... alyzer.pdf

If eth0 is the proper interface on your Network Analyzer server and you're not receiving any packets, that means that it's either being blocked (by the local firewall or a remote firewall/ACL) or the Cisco device is not sending it. Can you check if you can telnet from the Cisco device to that port on the server?