[c-nsp] NetFlow for Bandwidth Billing

[TCIS List Acct]

Adam Powers wrote:
> As a general statement, I believe NetFlow is an incredibly useful 
> traffic accounting technology – its application as a bandwidth billing 
> mechanism is proven. A few comments and things to consider based on my 
> experience working with NetFlow...
> 
> 1. Find a collector that supports NetFlow deduplication. One of the 
> biggest challenge you run into with NetFlow is duplicate NetFlow records 
> exported from multiple routers. You’ll want to be careful not to double 
> count yet catch everything sent/received by the logical IP block you’re 
> monitoring.

Yes, de-duplication seems to be key based on the responses I've gathered thus 
far -- any suggestions on a collector that has this feature?  As I mentioned 
previously, open source is OK, as is commercial, provided the latter has all of 
the features we need (which are fairly minimal at this point -- mainly to be 
able to account for bytes in/out on specific IPs, be able to add together totals 
from a range of IPs that a customer may have, and the de-duplication feature you 
mention)

> 2. Monitor cache utilization; dropped flows leads to under reporting of 
> traffic volume. Fortunately this is in the customer’s favor so not 
> usually an issue. Some level of product loss should be built into your 
> billing strategy anyway.

Understood.  I assume the cache parameters are set on the NetFlow sender side 
(in our case, Cisco 7206VXR/NPE400's).

> 3. Understand NetFlow v1/5/7’s limitations regarding multicast traffic. 
> Also remember that NetFlow monitors IP only.

Good to know, although we are only concerned with IP at the moment.

> 4. Verify that your cache timers are compatible with the collector’s 
> measurement intervals. Else you’ll get a nasty sawtooth effect that 
> customers won’t like.

Any more information regarding this specific issue would be appreciated (FAQs, etc).

TIA.

--Mike