OPERATIONAL DEFECT DATABASE
...
...
When Netflow version IPFIX (also known as version v10) is used to export Netflow records, exported sampler option records describing metadata about sampling parameters do not contain samplingSize, samplingPopulation and SelectorName parameters (InformationElement Ids 309, 310 and 335 respectively, RFC 5477). Currently the exported sampler option records contain only the following Information Elements; Selector Id: Information Element (IE) 302 Selector Algorithm : IE 304 Sampling Packet Interval : IE 305 Sampler Name: IE 84 In "Selector Algorithm", the field value given is "Random n-out-of-N packets sampling". Therefore, IE 309 and IE 310 are required as per rfc. In addition, IE 84 is now obsoleted and IE 335 is preferred.
In Netflow exporter-map configuration, IPFIX version is configured and the exporter-map is referenced in the monitor-map intended to capture and cache Netflow flow records. On the interface intended to have Netflow sampling, the monitor-map is applied with a sampler-map as in the configuration example below: flow exporter-map NETFLOW-EXPORT-MAP version ipfix destination 10.0.0.1 ! flow monitor-map NETFLOW-MONITOR-MAP record ipv6 exporter NETFLOW-EXPORT-MAP ! sampler-map NETFLOW-SAMPLER-MAP random 1 out-of 256 ! interface FourHundredGigE0/0/0/1 flow ipv6 monitor NETFLOW-MONITOR-MAP sampler NETFLOW-SAMPLER-MAP ingress With the above configuration, the Netflow process is expected to send periodic "option" records containing information about the sampler-map to the Netflow collector. It is found that the mentioned Information Elements are currently missing in such records. No other specific trigger required for this issue to manifest itself.
Currently IOS-XR supports Random n-out-of-N sampling, but only n=1 (1-out-of-N sampling) is configurable. ,With this in mind, actual traffic rate or similar parameters can be determined even with these missing Information Elements (IE 309 and IE 310). This is because IE305 "samplingPacketInterval" is present in the option record, and its value is the "N" in the 1-out-of-N sampling. In practice, many Netflow collectors use IE305 currently to calculate actual traffic rate. So customers may need to check with the owner of their Netflow Collector to confirm on this.
This issue is present in all IOS-XR releases prior to 7.8.2, but practically not a blocker for deployments due to the workarounds mentioned above. Therefore impact is low. The issue is specific to Netflow version IPFIX (v10) and version v9 is unaffected. There is no traffic impact. The issue does not need a special trigger, hence frequency of occurrence is 100%. The issue is fixed from 7.8.2, 7.9.1 and further releases. The issue affects all IOS-XR platforms which support Netflow.
Click on a version to see all relevant bugs
Cisco Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.
