[c-nsp] 6500 NDE CPU load

Phil Mayers p.mayers at imperial.ac.uk
Fri May 30 05:42:18 EDT 2008


We have a netflow collector from a Large Software Vendor on loan.

Said vendor waltzed in and coolly dropped into the conversation "yeah 
we'll be needing you to drop your flow timers to 60 seconds, including 
the "active flows" timer, else we won't get good results"

I was... less than impressed.

So I've been doing some statistical analysis of the distribution of flow 
ages and packet counts; once i've got the results, how can I predict the 
effect on CPU usage of a flow timer decrease?

So I'm thinking of effects like; with the timers at defaults (no fast 
aging, 5 minutes inactive, 30 minutes active) how often does the CPU 
walk the netflow tcam? How long does a walk take? Will there be locking 
or contention issues?

The box has sup720 PFC/DFC-3Bs and the netflow TCAM never overflows.


More information about the cisco-nsp mailing list