[c-nsp] netflow sampling

Marlon Duksa mduksa at gmail.com
Tue May 19 15:00:17 EDT 2009

Hi - Does anyone know what is netflow sampling? My understanding is that
when NetFlow is enabled, certain flows (determined by ACL, or all of the
flows on a port if there is no ACL) are cashed and stats for them updated.
After 'inactivity' timer expires, flow is deleted and the record exported.

But where is this sampling coming from? Is it sampling per flow - you count
some packet of the flow but not all? Or is it that you sample some flows
(each sampled flow accurately counting) but not the others, and you do this

Also in relation to netflow I see a lot of info like that '1:1500' and I
think this is related to purchasing/licensing options.What does this '1:x'
ratio means?

I understand the Netflow version (5,8,9) concept, don't need any info on
that. Just this sampling aspect is what confuse me.


More information about the cisco-nsp mailing list