Nde Overview; Nde From The Msfc; Nde From The Pfc - Cisco 6500 Series Software Configuration Manual

Understanding How NDE Works

NDE Overview

NDE makes routed-traffic statistics available for analysis by an external data collector. You can use NDE
to analyze all IP unicast traffic that is Layer 3-switched on the PFC and all IP unicast traffic that is routed
in software on the MSFC.
The Supervisor Engine 2 stores NetFlow statistics in the NetFlow table. The NDE configuration has no
effect on Layer 3 switching in hardware by the PFC2. If the NetFlow table has more than 32K entries,
there is an increased probability that there will be insufficient room to store statistics. On the Supervisor
Engine 2, no statistics are available for flows that are switched when the NetFlow table is full.
On the Supervisor Engine 1, NetFlow statistics are derived from the MLS cache, which is used primarily
for Layer 3 switching by the PFC. If you change the configuration to modify NDE, the new configuration
applies to PFC Layer 3 switching. For more information about Layer 3 switching by the PFC on
Supervisor Engine 1, see
Engine 1."
by the MSFC, and NetFlow statistics are available from the MSFC for flows that are routed by the MSFC.

NDE from the MSFC

The NetFlow cache on the MSFC captures statistics for routed flows.
NDE on the Catalyst 6500 series switches can use NDE version 1, 5, or 6 to export the statistics captured
on the MSFC for routed traffic. For more information, refer to this URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/switch_c/xcprt3/xcdnfov.htm

NDE from the PFC

These sections describe NDE from the PFC:
•
•
•
•
Flow Masks
The PFC uses a flow mask to create flow entries. The following flow masks exist:
•
•
•
Catalyst 6500 Series Switch Cisco IOS Software Configuration Guide—Release 12.1 E
33-2
Chapter 19, "Configuring IP Unicast Layer 3 Switching on Supervisor
On the Supervisor Engine 1, when the MLS cache is full, the PFC sends flows to be switched
Flow Masks, page 33-2
NDE Versions, page 33-3
MLS Cache Entries, page 33-6
Sampled NetFlow, page 33-6
destination—The least-specific flow mask. The PFC maintains one entry for each destination IP
address. All flows to a given destination IP address use this entry.
destination-source—A more-specific flow mask. The PFC maintains one entry for each source and
destination IP address pair. All flows between same source and destination IP addresses use this
entry.
destination-source-interface—A more-specific flow mask. Adds the source VLAN SNMP ifIndex to
the information in the destination-source flow mask. The destination-source-interface flow mask is
supported on Supervisor Engine 2 with Release 12.1(13)E and later releases.
Chapter 33 Configuring NDE
78-14099-04