[c-nsp] Netflow architecture

[Hank Nussbacher]

At 12:56 PM 01-04-06 -0800, Tom Zingale \(tomz\) wrote:
>Historically NetFlow captures ingress uni-directional traffic. There are
>recent NetFlow features which capture output or egress information on
>some platforms. Egress NetFlow is offered on most software platforms and
>some platforms with hardware implementations.
>
>The following links are for the egress or output features available:
>Egress NetFlow Accounting:
>http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_
>chapter09186a00805e395a.html

That links still leaves 12.2SX unclear.  It states as a note:
"In Cisco IOS 12.2S releases, egress NetFlow captures either IPv4 or MPLS 
packets as they leave the router." Yet near the bottom the table shows 
egress Netflow only on 12.3(11)T.

Also, in 12.2SX, I am unable to find egress Netflow.  Seems a bit strange 
that the focus of Cisco with its modular IOS in 12.2SXF would leave such a 
crucial function to other IOS trains.

-Hank


>Multicast Egress NetFlow
>http://www.cisco.com/en/US/products/sw/iosswrel/ps5187/products_feature_
>guide09186a00805256cb.html
>
>MPLS Egress NetFlow
>http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_
>chapter09186a00805e1253.html
>
>C12000 output NetFlow
>http://www.cisco.com/en/US/products/ps6601/products_white_paper09186a008
>018883a.shtml
>
>
>
> > -----Original Message-----
> > From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> > bounces at puck.nether.net] On Behalf Of Kanagaraj Krishna
> > Sent: Saturday, April 01, 2006 9:47 AM
> > To: cisco-nsp at puck.nether.net
> > Subject: Re: [c-nsp] Netflow architecture
> >
> > Hi,
> >    Currently we are using NTOP as a Netflow collector and our
>objective is
> > to
> > study our traffic pattern. Just curious whether Netflow information
>only
> > represents traffic leaving an interface (outgoing) OR does it cater to
> > vice
> > versa as well (incoming and outgoing)? The reason for my doubts is
>that
> > from
> > the sample that were collected, it can be seen that more traffic were
> > recorded
> > on external destination IP/AS. My observation could be wrong, if yes
> > please
> > enlighten me. Thanks.
> >
> > Regards,
> > Kana
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>_______________________________________________
>cisco-nsp mailing list  cisco-nsp at puck.nether.net
>https://puck.nether.net/mailman/listinfo/cisco-nsp
>archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>  +++++++++++++++++++++++++++++++++++++++++++
>  This Mail Was Scanned By Mail-seCure System
>  at the Tel-Aviv University CC.