[c-nsp] Netflow Operation

[Tom Zingale (tomz)]

NetFlow records the SysUptime when the flow is created and each time we
process a packet for a flow we also record the SysUptime. When the last
packet is received for the flow NetFlow has the start and end time of
the flow.  The stats for the flow are exported based on the flow timers.
The flow will be exported if inactive (inactive timer) or if the flow is
active for longer than the activer timer or if TCP indicates the flow
has ended.    

> -----Original Message-----
> From: Dave Temkin [mailto:dave at ordinaryworld.com] 
> Sent: Tuesday, December 13, 2005 10:45 AM
> To: Tom Zingale (tomz)
> Cc: cisco-nsp at puck.nether.net
> Subject: RE: [c-nsp] Netflow Operation
> 
> Right, but is each byte timestamped?  I'd imagine not - so 
> how often are those stats generated and how does it roll them up?
> 
> 
> On Tue, 13 Dec 2005, Tom Zingale (tomz) wrote:
> 
> >
> >
> > > -----Original Message-----
> > > From: cisco-nsp-bounces at puck.nether.net 
> > > [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of 
> Dave Temkin
> > > Sent: Tuesday, December 13, 2005 9:23 AM
> > > To: cisco-nsp at puck.nether.net
> > > Subject: [c-nsp] Netflow Operation
> > >
> > > Can anyone enlighten me about how a Netflow Export is 
> packaged?  I 
> > > understand that the timers dictate how often exports are sent 
> > > depending on flow types, but how are those flows constructed?
> >
> > The export formats are well documented in the Solution Guide:
> > 
> http://www.cisco.com/en/US/products/sw/netmgtsw/ps1964/products_implem
> > en tation_design_guide09186a00800d6a11.html
> >
> > >
> > > Does the export contain time-delineated records?
> >  ie, if my
> > > netflow package only presents 1 minute averages, has it actually 
> > > gotten true-to-time records in for all the ingress traffic on an 
> > > interface and it's just a limitation of the reporting agent??
> >
> > SysUptime is included for the beginning and end of the flow 
> record and 
> > exported with the flow.
> >
> >
> > >
> > >
> > > Thanks,
> > > -Dave
> > > _______________________________________________
> > > cisco-nsp mailing list  cisco-nsp at puck.nether.net 
> > > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > > archive at http://puck.nether.net/pipermail/cisco-nsp/
> > >
> >
>