[c-nsp] more net flow, which interfaces to monitor and in which direction?

[Roland Dobbins]

On May 22, 2014, at 1:31 AM, Scott Granados <scott at granados-llc.net> wrote:

> Is there an advantage to monitoring input flows only and if so what do you do to measure output? 

In almost all scenarios, you should use ingress NetFlow on all interfaces which are handling traffic.

You will get egress ifindex as a non-key field.

Ingress/egress in NDE configuration refers to where the telemetry is generated, not directionality of actual traffic.

So, if you enable ingress NetFlow on all your interfaces handling traffic, you're covered.  The only reason to use egress NetFlow is in certain topological situations (like various types of tunnels) in which you wouldn't otherwise be able to get the telemetry.

----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

                   Equo ne credite, Teucri.

    		   	  -- Laocoön