[c-nsp] Netflow vs SNMP

Gert Doering gert at greenie.muc.de
Mon Oct 2 02:36:08 EDT 2023


On Mon, Oct 02, 2023 at 09:13:55AM +0300, Hank Nussbacher via cisco-nsp wrote:
> When comparing traffic stats with SNMP, Netflow stats always appear too low
> (see attachment).
> Opened a TAC case and their recommendation is to do 1:1 and I quote:
> "Irrespective of the rate at which the NP punts the records to CPU, exporter
> picks up a maximum of 2000 records at a time from the cache that are
> eligible for export (timers, network/TCP session events, etc). This is
> basically to avoid NetIO dropping the packets due to lack of b/w. When the
> exporter wakes up again, it repeats the same."

I fail to see why it would make sense to increase the number of flow
exports if their reasoning is "$machinery is busy, so, flow exports are
exported slowly"...

I do like 1:1 netflow, but the ASR9k (at least the linecards we have)
are not suitable to do that, alas - flow cache does not go high enough,
and NPU PPS is limited.

We currently do 1:10, which mostly works OK for our load, but we still
see a few

LC/0/0/CPU0:Oct  2 08:14:24.825 MEDST: nfsvr[280]: %MGBL-NETFLOW-6-INFO_CACHE_SIZE_EXCEEDED : Cache size of 1000000 for monitor v4mon has been exceeded 

every day...  (from what I understand, there should be enough LC memory
to go higher with that cache, but it cannot be configured).

"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             gert at greenie.muc.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 630 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20231002/3b52ef2b/attachment.sig>

More information about the cisco-nsp mailing list