[c-nsp] 6k Netflow To Be or Not To Be...

Paolo Lucente pl+list at pmacct.net
Tue Nov 15 05:48:04 EST 2011


To add to the other replies that something that might work in
some scenarios - as others implied, most of it boils down to
what you actually use NetFlow data for - is collecting traffic
levels from a different source, ie. SNMP, and see how NetFlow
compares to that over time (ie.  under estimation patterns,
how much, etc.). Awareness is capital: it can even drive to
fixes/workarounds/etc that might work from you.

Cheers,
Paolo

On Mon, Nov 14, 2011 at 11:15:31AM -0600, Mark Mason wrote:
> Question of the day...
> Why turn on netflow in a 6k w/ SUP720-10G if netflow in 6k (minus the SUP2T) is notoriously not good? As Adam Powers from Lancope, I find myself continually tuning netflow aging due to TCAM exceeded log messages (http://netflowninjas.lancope.com/blog/2011/07/lancopes-adam-powers-on-the-netflow-features-of-ciscos-catalyst-6500-supervisor-2t.html).
> 
> Mark Mason



More information about the cisco-nsp mailing list