[c-nsp] Netflow architecture

[Tom Zingale (tomz)]

Egress NetFlow is not supported on Ca6k or 7600 except the recent
addition of multicast egress NetFlow in 12.2(18)SXF. 

> -----Original Message-----
> From: Hank Nussbacher [mailto:hank at efes.iucc.ac.il]
> Sent: Saturday, April 01, 2006 10:21 PM
> To: Tom Zingale (tomz); Kanagaraj Krishna; cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Netflow architecture
> 
> At 12:56 PM 01-04-06 -0800, Tom Zingale \(tomz\) wrote:
> >Historically NetFlow captures ingress uni-directional traffic. There
are
> >recent NetFlow features which capture output or egress information on
> >some platforms. Egress NetFlow is offered on most software platforms
and
> >some platforms with hardware implementations.
> >
> >The following links are for the egress or output features available:
> >Egress NetFlow Accounting:
>
>http://www.cisco.com/en/US/products/ps6350/products_configuration_guide
_
> >chapter09186a00805e395a.html
> 
> That links still leaves 12.2SX unclear.  It states as a note:
> "In Cisco IOS 12.2S releases, egress NetFlow captures either IPv4 or
MPLS
> packets as they leave the router." Yet near the bottom the table shows
> egress Netflow only on 12.3(11)T.
> 
> Also, in 12.2SX, I am unable to find egress Netflow.  Seems a bit
strange
> that the focus of Cisco with its modular IOS in 12.2SXF would leave
such a
> crucial function to other IOS trains.
> 
> -Hank
> 
> 
> >Multicast Egress NetFlow
>
>http://www.cisco.com/en/US/products/sw/iosswrel/ps5187/products_feature
_
> >guide09186a00805256cb.html
> >
> >MPLS Egress NetFlow
>
>http://www.cisco.com/en/US/products/ps6350/products_configuration_guide
_
> >chapter09186a00805e1253.html
> >
> >C12000 output NetFlow
>
>http://www.cisco.com/en/US/products/ps6601/products_white_paper09186a00
8
> >018883a.shtml
> >
> >
> >
> > > -----Original Message-----
> > > From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> > > bounces at puck.nether.net] On Behalf Of Kanagaraj Krishna
> > > Sent: Saturday, April 01, 2006 9:47 AM
> > > To: cisco-nsp at puck.nether.net
> > > Subject: Re: [c-nsp] Netflow architecture
> > >
> > > Hi,
> > >    Currently we are using NTOP as a Netflow collector and our
> >objective is
> > > to
> > > study our traffic pattern. Just curious whether Netflow
information
> >only
> > > represents traffic leaving an interface (outgoing) OR does it
cater to
> > > vice
> > > versa as well (incoming and outgoing)? The reason for my doubts is
> >that
> > > from
> > > the sample that were collected, it can be seen that more traffic
were
> > > recorded
> > > on external destination IP/AS. My observation could be wrong, if
yes
> > > please
> > > enlighten me. Thanks.
> > >
> > > Regards,
> > > Kana
> > > _______________________________________________
> > > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > > archive at http://puck.nether.net/pipermail/cisco-nsp/
> >
> >_______________________________________________
> >cisco-nsp mailing list  cisco-nsp at puck.nether.net
> >https://puck.nether.net/mailman/listinfo/cisco-nsp
> >archive at http://puck.nether.net/pipermail/cisco-nsp/
> >
> >  +++++++++++++++++++++++++++++++++++++++++++
> >  This Mail Was Scanned By Mail-seCure System
> >  at the Tel-Aviv University CC.