[c-nsp] 6500 netflow export and the switch cpu

[cc loo]

I was wondering if mirroring the traffic into a server with Netflow probes
(such as fprobe) to help relieving the stress on router's CPU would be a
wise move ?
Is this move common in ISP environments or do most of the big guys just
leave the exporting from routers to collectors ?



On Thu, Sep 11, 2008 at 11:50 PM, Jon Lewis <jlewis at lewis.org> wrote:

> I've got a 6509 with sup720-3bxl running 12.2(18)SXD7b.  It's forwarding
> several hundred mbit/s across a number of gig ports on WS-X6416-GBIC cards.
>
> I've noticed it's gotten very slow at certain things (like write mem), and
> when looking at the switch (remote command switch show proc cpu), I was kind
> of shocked to see 85% CPU utilization or higher across all time avgs. The
> biggest CPU eating process seems to be netflow export
>
>  223  2563111984 126342970      20287 38.27% 42.39% 42.03%   0 NDE - IPV4
>
> Other than disabling export or moving traffic off this device, are there
> things I can do to tone this down?  The couple hundred mbit/s this switch is
> forwarding is supposed to be no big deal for this platform.
>
> ----------------------------------------------------------------------
>  Jon Lewis                   |  I route
>  Senior Network Engineer     |  therefore you are
>  Atlantic Net                |
> _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>