[c-nsp] Cisco 6500/7600 netflow questions

[Phil Bedard]

That's really the  meat of my question.  With the sampling enabled on  
all of our ingress interfaces, what exactly is being exported?
On the software-based platforms the sampling builds the netflow  
tables, on the 6500/7600 there is the hardware MLS netflow cache  
which is
always active.

Phil


On Nov 13, 2006, at 9:48 AM, Adam Powers wrote:

> Unless you’re trying to cut down on network load from NetFlow  
> packets or you’re collector can’t handle it, you’re better off NOT  
> using sampled NetFlow on the 6500.
>
> To my knowledge (unless something has changed) the 6500 doesn’t  
> actually sample in the same way as that of the GSRs. The cache is  
> fully populated as in “full NetFlow” and then sampled on export.  
> That is, the cache contains all normal NetFlow data (which is what  
> you’re seeing) but the exported records contain only 1 in <whatever>.
>
> There is no performance gain for the 6500. In fact, the process of  
> sampling the cache on export adds additional overhead.
>
> -- 
>
> Adam  Powers
>
>
>
> On 11/13/06 9:32 AM, "Phil Bedard" <philxor at gmail.com> wrote:
>
>>        We are currently using sampled netflow on our 6500/7600s using
>> 12.2SXF and I have a few questions about
>> sampled netflow on those boxes.   My question is what is being
>> populated when the packets are sampled, and at the export
>> interval, what exactly is being exported.   I can do a show ip cache
>> flow (or show mls netflow ip) and see entries with
>> packet counts in the 25-100 range, but none of the flows I see
>> exported have more than 2 packets reported.
>>
>>         Is it sampling packets between export intervals, adding them
>> to a cache to be exported, and then flushes that cache
>> on export?
>>
>> Phil
>>
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>
>

Phil Bedard
philxor at gmail.com