Running ASR9906 w/ IOS-XR version 7.5.2 and doing 1:15 Netflow export on
all interfaces (ingress only).
When comparing traffic stats with SNMP, Netflow stats always appear too
low (see attachment).
Opened a TAC case and their recommendation is to do 1:1 and I quote:
"Irrespective of the rate at which the NP punts the records to CPU,
exporter picks up a maximum of 2000 records at a time from the cache
that are eligible for export (timers, network/TCP session events, etc).
This is basically to avoid NetIO dropping the packets due to lack of
b/w. When the exporter wakes up again, it repeats the same."
Does this make sense to go 1:1 which will only increase the number of
Netflow record to export? Everyone that does 1:1000 or 1:10000
sampling, do you also seen a discrepancy between Netflow stats vs SNMP
stats?
Thanks,
Hank
_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
all interfaces (ingress only).
When comparing traffic stats with SNMP, Netflow stats always appear too
low (see attachment).
Opened a TAC case and their recommendation is to do 1:1 and I quote:
"Irrespective of the rate at which the NP punts the records to CPU,
exporter picks up a maximum of 2000 records at a time from the cache
that are eligible for export (timers, network/TCP session events, etc).
This is basically to avoid NetIO dropping the packets due to lack of
b/w. When the exporter wakes up again, it repeats the same."
Does this make sense to go 1:1 which will only increase the number of
Netflow record to export? Everyone that does 1:1000 or 1:10000
sampling, do you also seen a discrepancy between Netflow stats vs SNMP
stats?
Thanks,
Hank
_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/