[c-nsp] 7304 and netflow under heavy traffic load

[Joe Loiacono]

You might try adjusting the expiration timers to expire the flows more 
quickly. Or perhaps these are long flows that aren't completing until well 
past the period you're interested in (e.g., FTP) 

As far as the reporting goes - is the tool reporting the flows in the 
period they actually occured, or in the period they were received?

Joe




Rich Lemmerman <rich_lemmerman at yahoo.ca> 
Sent by: cisco-nsp-bounces at puck.nether.net
07/29/2006 03:52 PM
Please respond to
Rich Lemmerman <rich_lemmerman at yahoo.ca>


To
cisco-nsp at puck.nether.net
cc

Subject
[c-nsp] 7304 and netflow under heavy traffic load






Having an unusual netflow issue with the 7304 which we are planning to use 
as our edge router at a not-too-large data center.  When a specific 
destination address (but hundreds of ports) receives heavy traffic, the 
netflow records reduces considerably for that destination but stays steady 
overall.  However when the heavy traffic subsides, the really old netflow 
records associated with that destination show up tardily.  The effect is 
that one of the several real-time netflow analysis tool reports the heavy 
traffic after the traffic has subsided.

Is it the case that the 7304 is underpowered relative to netflow 
generation of this kind or is there a potential problem with the 7304 or 
its IOS or its config relative to netflow.

Thanks
- Rich 

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/