[j-nsp] Netflow data exporting ability on M160

[Richard A Steenbergen]

On Sat, Nov 27, 2004 at 04:01:42PM +0800, Joe Shen wrote:
> Hi,
> 
> I'm collecting netflow export data from two M160 box.
> With one box(m160-1), there are three 2.5Gbps POS
> interface monitored with samping rate of 1:500, the
> other M160(m160-2) has only on 2.5Gbps POS interface
> monitored at the same sampling rate.
> 
> I use flow-tools and CUFlow to do post processing.
> After processing raw data collected by flowtools, I
> invoke CUGrapher.cgi ( a part of CUFlow) to graph
> those data analized. It shows, the total bandwidth
> utilized of M160-1 and that of M160-2 are nearly
> identical, that is, both of them taked a burden of
> 2.1Gbps( both direction). But the real situation is: 
> "show interfaces" shows each POS interface has a
> burden around 2.1Gbps (all day time).  
> 
> Checking the amount of disk space occupied by raw 
> data of two m160s, M160-2's data accumulates to about 
> 2/3 of M160-1's. 
> 
> As I know Cisco's netflow export is limited by its
> lince card packet processing ability , is M160 also
> has such limitations? 

IIRC the magic cutoff for classic netflow processing without one of the 
funky service cards for it is 7000pps of sampled data. With a 500:1 sample 
rate, that means you would top out at 3.5Mpps. If you're going to do more 
than that, sample less frequently.

-- 
Richard A Steenbergen <ras at e-gerbil.net>       http://www.e-gerbil.net/ras
GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)