[c-nsp] 6500 real world (sampled) netflow

Randy amps at djlab.com
Sat Aug 31 20:57:47 EDT 2013


What are the real world impacts (FIB, TCAM, CPU) of enabling 1/2048 
sampled netflow on a 6500 (3bxl w/DFC and 1G RAM on all line cards) 
carrying several full BGP tables and 10 gigs of max traffic?   It would 
only be used for detecting inbound UDP floods and other high PPS 
anomalies so there is no need for full flows or even much details, just 
ip src/dst.  Is it possible without CPU and BGP sessions flapping in the 
wind?

-- 
Randy M



More information about the cisco-nsp mailing list