Marat, Typically Cisco ASA emits flows on the basis of an event such as, for example, "a Flow is deleted" or "a Flow is denied". You have to configure your ASA in order to get proper flow exports for the events you care.
This is the Cisco ASA NetFlow implementation that explains in detail: https://www.cisco.com/c/en/us/td/docs/security/asa/special/netflow/guide/asa_netflow.html Regards, Simone On Mon, Jan 30, 2017 at 9:01 AM, Marat Khalili <m...@rqc.ru> wrote: > On 26/01/17 15:09, Robert Williams wrote: > >> The Cisco uses 1 in 20 sampling for Netflow >> > Sorry for deviation, do you know what Ciscos use it? I have very strange > results with ntop+netflow on Cisco ASA here (fw 9.6.2), but cannot find > time to investigate. No Cisco ASA documents on netflow mention any sampling > rate. > > With Best Regards, > Marat Khalili > > _______________________________________________ > Ntop mailing list > Ntop@listgateway.unipi.it > http://listgateway.unipi.it/mailman/listinfo/ntop >
_______________________________________________ Ntop mailing list Ntop@listgateway.unipi.it http://listgateway.unipi.it/mailman/listinfo/ntop
