[c-nsp] Fwd: Netflow v9 - sampling and IOS

[Dmitri Bouianovski (dbouiano)]

> -----Original Message-----
> From: Paul Aitken (paitken) 
> Sent: Monday, June 16, 2008 10:17 AM
> To: peter.haag at switch.ch
> Cc: Roland Dobbins (rdobbins); cs-netflow (mailer list); 
> cisco-nsp at puck.nether.net
> Subject: Re: Fwd: [c-nsp] Netflow v9 - sampling and IOS
> 
> Peter,
> 
> > Hi Cisco gurus, For the next developing steps for my nfdump 
> tools, I 
> > would like to implement sampling - a feature, which a lot of users 
> > would like to have. Sampling for v5 is announced in the v5 
> header and  
> > therefore easy to recognize.
> 
> No it's not.
> 
> 3 bits of v5 sampler ID are hacked into the padding at the 
> end of the v5 data records. This isn't available on all 
> platforms, and isn't officially supported in the netflow v5 protocol.
> 
> 
> > For v9, the tags 34 and 35 (SAMPLING_INTERVAL and SAMPLING_ALGORITHM
> > ) are defined in the specs, but it seams as the IOS does not export 
> > sampling information using these tags.
> 
> Correct. I don't see them being used anywhere in our code.


I believe they are still used in 12.0S on c12000 aka GSR.

-D

> 
> 
> > Googling lots of CISCO papers does not reveal more 
> information on this 
> > issue. So can anybody shed some light on the question how IOS 
> > announces sampling in v9? Which platform/IOS combination do work or 
> > are required to get sampling information in the netflow records?
> 
> In v9 export, there's a sampler option which contains the 
> following fields:
> 
> FLOW_SAMPLER_ID               #48
> FLOW_SAMPLER_MODE             #49
> FLOW_SAMPLER_RANDOM_INTERVAL  #50
> 
> The sampler ID is also provided in the v9 IPv4 record.
> 
> Unfortunately this information isn't available in the netflow 
> v5 export format.
> 
> --
> Paul Aitken
> Cisco Systems Ltd, Edinburgh, Scotland.
>