Kingsley,
Is this a question? Regards, Tyson Scott - CCIE #13513 R&S, Security, and SP Managing Partner / Sr. Instructor - IPexpert, Inc. Mailto: <mailto:[email protected]> [email protected] Telephone: +1.810.326.1444, ext. 208 Live Assistance, Please visit: <http://www.ipexpert.com/chat> www.ipexpert.com/chat eFax: +1.810.454.0130 IPexpert is a premier provider of Self-Study Workbooks, Video on Demand, Audio Tools, Online Hardware Rental and Classroom Training for the Cisco CCIE (R&S, Voice, Security & Service Provider) certification(s) with training locations throughout the United States, Europe, South Asia and Australia. Be sure to visit our online communities at <http://www.ipexpert.com/communities> www.ipexpert.com/communities and our public website at <http://www.ipexpert.com/> www.ipexpert.com From: [email protected] [mailto:[email protected]] On Behalf Of Kingsley Charles Sent: Monday, July 12, 2010 7:55 AM To: [email protected] Subject: [OSL | CCIE_Security] Netflow aggregration Hi all A flow record is created, when a flow expires. The following are conditions for expiration of a flow: . <http://www.cisco.com/univercd/illus/images/blank.gif> Flows which have been idle for a specified time are expired and removed from the cache . <http://www.cisco.com/univercd/illus/images/blank.gif> Long lived flows are expired and removed from the cache (flows are not allowed to live more than 30 minutes by default, the underlying packet conversation remains undisturbed) . <http://www.cisco.com/univercd/illus/images/blank.gif> As the cache becomes full a number of heuristics are applied to aggressively age groups of flows simultaneously . <http://www.cisco.com/univercd/illus/images/blank.gif> TCP connections which have reached the end of byte stream (FIN) or which have been reset (RST) will be expired. Version 9 supports aggregation. The flow record creating in ver 9 is bit different. As per this link, after the expiration of the flow, it is moved to corresponding aggregate cache. Again after timeout in the aggregation cache only, a flow record is created. I don't get it, how can the flow timeout in the aggregation cache which has already been timed out in the main cache. router(config)#ip flow-aggregation cache prefix router(config-flow-cache)#cache timeout ? active Specify the active flow timeout inactive Specify the inactive flow timeout http://www.cisco.com/en/US/products/sw/netmgtsw/ps1964/products_implementati on_design_guide09186a00800d6a11.html With regards Kings
_______________________________________________ For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com
