[c-nsp] netflow sampling

Marlon Duksa mduksa at gmail.com
Tue May 19 15:00:17 EDT 2009


Hi - Does anyone know what is netflow sampling? My understanding is that
when NetFlow is enabled, certain flows (determined by ACL, or all of the
flows on a port if there is no ACL) are cashed and stats for them updated.
After 'inactivity' timer expires, flow is deleted and the record exported.

But where is this sampling coming from? Is it sampling per flow - you count
some packet of the flow but not all? Or is it that you sample some flows
(each sampled flow accurately counting) but not the others, and you do this
randomly?

Also in relation to netflow I see a lot of info like that '1:1500' and I
think this is related to purchasing/licensing options.What does this '1:x'
ratio means?

I understand the Netflow version (5,8,9) concept, don't need any info on
that. Just this sampling aspect is what confuse me.

Thanks,
Marlon


More information about the cisco-nsp mailing list