At 02:41 PM 7/6/2009, Julio Arruda noted:
Justin Krejci wrote:
> Thanks,
>
> ip flow ingress is already defined on my setup
>
> We are trying to avoid sampling (currently we're not seeing any contention
> or other load issues)
As I understand, netflow sampling in the current 7600/6500 based gear,
would not help with Netflow TCAM contention...
Is more on the lines of "after-the-fact", it will do some kind of
sampling of the already collected information..
Correct, it is a sampling of the flows that made it into the hw. It
does not appear from the outputs that any significant contention is happening.
EARL8, like in the Nexus 7K, is supposed to do packet-sampling 'as other
boxes do', before creating the netflow entry.
That it does, we do both full & sampled NF. Eg, with 1 in 1000
sampling, 1 packet out of 1000 passing the interface in the specified
direction (7k supports both ingress & egress NF) is sampled, and that
packet creates/updates a flow entry in the hw table.
Once in the hw, the flow entry is treated as any other, ie, updated,
aged, exported.
HTH,
Tim
>
> Apparently when putting in "ip route-cache flow" it changes the syntax to
> "ip flow ingress"
>
> conf t
> int g5/1
> no ip flow ingress
> no ip route-cache flow
> ip route-cache flow
> end
> show run | section interface GigabitEthernet5/1
>
> yields:
> ip flow ingress
>
>
> -----Original Message-----
> From: cisco-nsp-boun...@puck.nether.net
>
[<mailto:cisco-nsp-boun...@puck.nether.net>mailto:cisco-nsp-boun...@puck.nether.net]
On Behalf Of Peter Kranz
> Sent: Monday, July 06, 2009 2:25 PM
> To: cisco-nsp@puck.nether.net
> Subject: Re: [c-nsp] Netflow Collector shows minimal bandwidth from 6509
>
> We needed the following to see all of the flow data (we use sampling as
> well):
>
> int x/x
> ip flow ingress
> ip route-cache flow
> mls netflow sampling
>
> Peter Kranz
> Founder/CEO - Unwired Ltd
> www.UnwiredLtd.com
> Desk: 510-868-1614 x100
> Mobile: 510-207-0000
> pkr...@unwiredltd.com
>
>
> -----Original Message-----
> From: cisco-nsp-boun...@puck.nether.net
>
[<mailto:cisco-nsp-boun...@puck.nether.net>mailto:cisco-nsp-boun...@puck.nether.net]
On Behalf Of Andreas Bourges
> Sent: Monday, July 06, 2009 7:39 AM
> To: cisco-nsp@puck.nether.net
> Subject: Re: [c-nsp] Netflow Collector shows minimal bandwidth from 6509
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi,
>
> On Monday 06 July 2009 16:01:42 Justin Krejci wrote:
>>
>> interface GigabitEthernet5/1
>>
>> ip flow ingress
>>
>> ip flow egress
>
> ...ip flow egress will only catch the software-processed flows. So you will
> need to modify your netflow setup to enable ip flow ingress on all layer3
> interfaces to catch all output traffic for gig5/1.
>
> which doesn't explain why you're still missing 50% of your ingress flows ?!
>
>
> Regards,
>
> Andy
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
>
> iEYEARECAAYFAkpSDH0ACgkQRrny/uOBVy43UACgoOdfbyaS8X8Td34Twi5OUJID
> RAEAnjZiiCWqdDBiNXavjk5DTkLBr+ei
> =9gLx
> -----END PGP SIGNATURE-----
> _______________________________________________
> cisco-nsp mailing list cisco-nsp@puck.nether.net
>
<https://puck.nether.net/mailman/listinfo/cisco-nsp>https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at
<http://puck.nether.net/pipermail/cisco-nsp/>http://puck.nether.net/pipermail/cisco-nsp/
>
> _______________________________________________
> cisco-nsp mailing list cisco-nsp@puck.nether.net
>
<https://puck.nether.net/mailman/listinfo/cisco-nsp>https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at
<http://puck.nether.net/pipermail/cisco-nsp/>http://puck.nether.net/pipermail/cisco-nsp/
>
> _______________________________________________
> cisco-nsp mailing list cisco-nsp@puck.nether.net
>
<https://puck.nether.net/mailman/listinfo/cisco-nsp>https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at
<http://puck.nether.net/pipermail/cisco-nsp/>http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
<https://puck.nether.net/mailman/listinfo/cisco-nsp>https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at
<http://puck.nether.net/pipermail/cisco-nsp/>http://puck.nether.net/pipermail/cisco-nsp/
Tim Stevenson, tstev...@cisco.com
Routing & Switching CCIE #5561
Technical Marketing Engineer, Cisco Nexus 7000
Cisco - http://www.cisco.com
IP Phone: 408-526-6759
********************************************************
The contents of this message may be *Cisco Confidential*
and are intended for the specified recipients only.
_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
