On 22 Feb 2016, at 11:31, [email protected] wrote:
> "Robert Franklin" <[email protected]> wrote:
>
>> I've not measured this exactly but our Netflow collectors (running nfcapd)
>> are recording about 80-100,000 flows
>> per second across about 17 routers and 2 Cisco ASAs with NFSen. That's just
>> over 50M flows per 10 minute file -
>> each about 1.2GB in size.
>
> Sounds good. Are you doing full Netflow export, or have the routers doing
> sampling and export sampled flows?
It's full export from all of Cisco Catalyst 6500s + Sup 720 using NetFlow v9
and 6880-X + Nexus 7010 using Flexible NetFlow and ASA 5585-X using NetFlow
with NFSen.
The Flexible NetFlow records are being match/exported using 'platform-original
ipv4 interface-full'.
> In our case, ATM and GigE interfaces are exporting sampled flows. Which
> messes around byte volumes when comparing with other data sets. But our
> network guys are telling me it burns too much router CPU having these
> interfaces do full flow exporting of traffic routed.
Depends on your traffic levels I think -- I had to tune the parameters on the
Catalyst 6880-Xs (which are our border routers with the internet) to get a
balance between table size and CPU load. We have the XL tables (1M flows) and
the following timers:
Timers:
Local Global
Inactive Timeout: 7 secs 300 secs
Active Timeout: 32 secs 64 secs
Update Timeout: 1800 secs
Fast Timeout: 5 secs, 15 packets
The tables are mostly OK but will occasionally fill up on occasional bursts
(once per hour or two) - the CPU load is 20% average and peaks at 30-40%.
The 6880-Xs are a lot better than the old 6500 + Supervisor 720s we used to
have in that role: the CPUs are much faster.
- Bob
--
Bob Franklin [email protected] / (+44 1223 7) 48479
Networks, University Information Services, University of Cambridge
------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140
_______________________________________________
Nfdump-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
