[c-nsp] 6500 netflow export and the switch cpu

[Jon Lewis]

On Thu, 11 Sep 2008, Phil Mayers wrote:

>>  current ip   flowmask for unicast:   if-full
>>  current ipv6 flowmask for unicast:    null
>
> Do you need the full mask? It includes tcp/udp ports. Dropping to 
> destination-source may save you a lot of flows (but obviously lose you a lot 
> of info)

I'd really like to keep ip-full.  It's quite handy when tracking down what 
an IP has been up to (like when trying to verify infection/scanning 
complaints).

----------------------------------------------------------------------
  Jon Lewis                   |  I route
  Senior Network Engineer     |  therefore you are
  Atlantic Net                |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________