[c-nsp] Netflow architecture

[Tom Zingale (tomz)]

Historically NetFlow captures ingress uni-directional traffic. There are
recent NetFlow features which capture output or egress information on
some platforms. Egress NetFlow is offered on most software platforms and
some platforms with hardware implementations. 

The following links are for the egress or output features available:
Egress NetFlow Accounting:
http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_
chapter09186a00805e395a.html

Multicast Egress NetFlow
http://www.cisco.com/en/US/products/sw/iosswrel/ps5187/products_feature_
guide09186a00805256cb.html

MPLS Egress NetFlow
http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_
chapter09186a00805e1253.html

C12000 output NetFlow
http://www.cisco.com/en/US/products/ps6601/products_white_paper09186a008
018883a.shtml



> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Kanagaraj Krishna
> Sent: Saturday, April 01, 2006 9:47 AM
> To: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Netflow architecture
> 
> Hi,
>    Currently we are using NTOP as a Netflow collector and our
objective is
> to
> study our traffic pattern. Just curious whether Netflow information
only
> represents traffic leaving an interface (outgoing) OR does it cater to
> vice
> versa as well (incoming and outgoing)? The reason for my doubts is
that
> from
> the sample that were collected, it can be seen that more traffic were
> recorded
> on external destination IP/AS. My observation could be wrong, if yes
> please
> enlighten me. Thanks.
> 
> Regards,
> Kana
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/