[c-nsp] Netflow vs SNMP

Hank Nussbacher hank at interall.co.il
Mon Oct 2 02:13:55 EDT 2023


Running ASR9906 w/ IOS-XR version 7.5.2 and doing 1:15 Netflow export on 
all interfaces (ingress only).

When comparing traffic stats with SNMP, Netflow stats always appear too 
low (see attachment).

Opened a TAC case and their recommendation is to do 1:1 and I quote:

"Irrespective of the rate at which the NP punts the records to CPU, 
exporter picks up a maximum of 2000 records at a time from the cache 
that are eligible for export (timers, network/TCP session events, etc). 
This is basically to avoid NetIO dropping the packets due to lack of 
b/w. When the exporter wakes up again, it repeats the same."


Does this make sense to go 1:1 which will only increase the number of 
Netflow record to export?  Everyone that does 1:1000 or 1:10000 
sampling, do you also seen a discrepancy between Netflow stats vs SNMP 
stats?


Thanks,

Hank


More information about the cisco-nsp mailing list