Those who read Part 1 of this post know that on Huawei routers for netstream packet sequence numbers to increase sequantially as defined in RFC3954 "ip netstream export sequence-mode packet"must be exclusively configured. However a problem still exists:
On Huawei routers with VRP5, no matter the device is configured with flow or packet mode, sequence numbers are independent for data and data template packets with current software design which results in for a netflow analyzer to misinterpret netflow data as there are missing flows.
On Huawei routers with VRP8 the situation is a bit worse cause even the packet mode command "ip netstream export sequence-mode packet" do not exist.
The solution for both sequence numbers to increase sequantially and for data and data template packets to have dependent flow numbers is to install V8R9C10 version. Other than that if you use VRP6 based software, you could increase data template frequency as in below configuration by changing refresh interval to 50minutes and every 30 packets to get affected less:
[HUAWEI] system-view [~HUAWEI] ip netstream export template option timeout-rate 50 [~HUAWEI] ip netstream export template option refresh-rate 30
Posts
