[c-nsp] 6k Netflow To Be or Not To Be...

[Phil Mayers]

On 11/15/2011 03:25 AM, Dobbins, Roland wrote:
>
> On Nov 15, 2011, at 5:57 AM, Nick Hilliard wrote:
>
>> pfc3 netflow is fine if you need to measure traffic ratios or
>> protocol spread.
>
> Actually, in any kind of diverse source/dest/layer-4 environment, it
> isn't, due to non-deterministic statistical skewing due to mls table
> overflow.

IF you overflow.

Some (perhaps relatively small or quiet) networks can run without 
overflowing, or with only very occasional overflows. We do.