[c-nsp] Netflow/Sflow for "irrelevant" traffic?

[Drew Weaver]

So just for a refresher if you are sampling lets say at 1:500 and lets say 1 byte goes through an interface that is not intended to produce an export?

The exporting only happens if the amount of data is over a certain threshold? Does that threshold vary?

-----Original Message-----
From: cisco-nsp <cisco-nsp-bounces at puck.nether.net> On Behalf Of Dobbins, Roland
Sent: Thursday, July 30, 2020 8:18 AM
To: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Netflow/Sflow for "irrelevant" traffic?



> On 30 Jul 2020, at 18:48, Drew Weaver <drew.weaver at thenap.com> wrote:
> 
> I'm just curious mostly but has anyone found a platform that has high enough sflow/netflow "resolution" that it picks up things like single pings, or broadcast traffic, or other very low volume traffic?

I think what you’re looking for is gear which supports 1:1 flow telemetry at the interface speeds/densities you require.

--------------------------------------------
Roland Dobbins <roland.dobbins at netscout.com>



_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/