[j-nsp] Netflow data exporting ability on M160
Richard A Steenbergen
ras at e-gerbil.net
Sat Nov 27 11:47:10 EST 2004
On Sat, Nov 27, 2004 at 04:01:42PM +0800, Joe Shen wrote:
> I'm collecting netflow export data from two M160 box.
> With one box(m160-1), there are three 2.5Gbps POS
> interface monitored with samping rate of 1:500, the
> other M160(m160-2) has only on 2.5Gbps POS interface
> monitored at the same sampling rate.
> I use flow-tools and CUFlow to do post processing.
> After processing raw data collected by flowtools, I
> invoke CUGrapher.cgi ( a part of CUFlow) to graph
> those data analized. It shows, the total bandwidth
> utilized of M160-1 and that of M160-2 are nearly
> identical, that is, both of them taked a burden of
> 2.1Gbps( both direction). But the real situation is:
> "show interfaces" shows each POS interface has a
> burden around 2.1Gbps (all day time).
> Checking the amount of disk space occupied by raw
> data of two m160s, M160-2's data accumulates to about
> 2/3 of M160-1's.
> As I know Cisco's netflow export is limited by its
> lince card packet processing ability , is M160 also
> has such limitations?
IIRC the magic cutoff for classic netflow processing without one of the
funky service cards for it is 7000pps of sampled data. With a 500:1 sample
rate, that means you would top out at 3.5Mpps. If you're going to do more
than that, sample less frequently.
Richard A Steenbergen <ras at e-gerbil.net> http://www.e-gerbil.net/ras
GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)
More information about the juniper-nsp