NetFlow: Difference between revisions

Revision as of 21:29, 17 April 2005

Revision as of 20:53, 20 May 2005

Line 5:

Netflow records are sent via UDP, and for efficiency reasons, the router does not store flow records once they are exported. Therefore, if the netflow record is dropped due to network congestion, it is lost forever -- there's no way for the router to resend it. The IP address of the netflow collector and the port upon which it is listening must be configured on the sending router. Netflow is also enabled on a per-interface basis to avoid unnecessarily burdening the router's processor.

Maintaining netflow data can be computationally expensive for the router and burden the router's [[Central processing unit|CPU]] to the point where it runs out of capacity. To avoid problems caused by router CPU exhaustion, Cisco provides "sampled netflow". Rather than looking at every packet to maintain netflow records, the router looks thatat every ''n''th packet, where ''n'' can be configured. When sampled netflow is used, the netflow records must be adjusted for the effect of sampling -- traffic volumes, in particular, are now an estimate rather than the actual measured flow volume.

{{comp-stub}}