[c-nsp] Cisco 6500/7600 netflow questions

[Adam Powers]

Unless you¹re trying to cut down on network load from NetFlow packets or
you¹re collector can¹t handle it, you¹re better off NOT using sampled
NetFlow on the 6500.

To my knowledge (unless something has changed) the 6500 doesn¹t actually
sample in the same way as that of the GSRs. The cache is fully populated as
in ³full NetFlow² and then sampled on export. That is, the cache contains
all normal NetFlow data (which is what you¹re seeing) but the exported
records contain only 1 in <whatever>.

There is no performance gain for the 6500. In fact, the process of sampling
the cache on export adds additional overhead.

-- 

Adam  Powers



On 11/13/06 9:32 AM, "Phil Bedard" <philxor at gmail.com> wrote:

>         We are currently using sampled netflow on our 6500/7600s using
> 12.2SXF and I have a few questions about
> sampled netflow on those boxes.   My question is what is being
> populated when the packets are sampled, and at the export
> interval, what exactly is being exported.   I can do a show ip cache
> flow (or show mls netflow ip) and see entries with
> packet counts in the 25-100 range, but none of the flows I see
> exported have more than 2 packets reported.
> 
>         Is it sampling packets between export intervals, adding them
> to a cache to be exported, and then flushes that cache
> on export?
> 
> Phil
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>