Incorrect Netflow InputInt/OutputInt number sent

Products

• Asset Management Solution
• ProxySG Software - SGOS

Issue/Introduction

In the example below, SG could send Netflow traffic for interface 1:0 despite having being removed from the Netflow configuration.

    Interface 0:0: Intel Gigabit     with no link
    Interface 1:0: Intel Gigabit     with no link
    Interface 2:0: Intel Gigabit     copper running at 1 Gbps full duplex
    Interface 2:1: Intel Gigabit     with no link

!- BEGIN netflow
netflow ;mode
enable
collectors ;mode
add 172.22.2.2 2055
exit
interfaces ;mode
remove 0:0 in
remove 0:0 out
remove 1:0 in        <<<<<
remove 1:0 out        <<<<<
remove 2:1 in
remove 2:1 out
exit
exit
!- END netflow

Packet capture shows that SG is sending Netflow information for InputInt/OutputInt 0 and InputInt/OutputInt 4 which belongs to interface 1:0.

Cisco NetFlow/IPFIX
    Version: 5
    Count: 30
    SysUptime: 493575000
    Timestamp: Apr 16, 2014 11:24:30.000000000 Malay Peninsula Standard Time
    FlowSequence: 132564120
    EngineType: RP (0)
    EngineId: 0
    00.. .... .... .... = SamplingMode: No sampling mode configured (0)
    ..00 0000 0000 0000 = SampleRate: 0
    pdu 1/30
        SrcAddr: 172.23.2.3 (172.23.2.3)
        DstAddr: 172.22.2.2 (172.22.2.2)
        NextHop: 0.0.0.0 (0.0.0.0)
>       InputInt: 4                <<<<<
        OutputInt: 0

Note : Output interface is 0 when SG is the originator/terminator.

Resolution

This has been addressed by B#200816 in SG 6.5.4.3 and newer SG 6.5 versions.

Upgrading to SG 6.5.4.3 or a newer SG 6.5 version should address this defect.