[c-nsp] Time based netflow sampling on 7600

[Andrew Cheng]

Hi Everybody


Has anybody had any real world experiences running time based sampling
on a 7600 as a way to still be able to extrapolate traffic through the
box even if the TCAM cache fills up? 

From what I've read in the documentation, if you configure say a time
based sampling rate of 1024, it simply exports the first 4ms of every
4096ms window (router actually says 8 in 8192). Hence, if the cache
fills up within the export interval, you can still multiple by the
sampling rate and get something rather accurate. 

I've tested this in a lab environment with 25kflows/sec of non-bursty
traffic, (ie, not even filling the TCAM in the 8192ms window) and the
netflow records are way way out. However if I change to packet based
sampling, they're 99% accurate (That is until flows/sec increase and
fill the TCAM of course..)

Thanks

Andrew





This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it.