-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Ian Cox wrote: > At 07:12 PM 4/17/2008 +0200, Gert Doering wrote: >> Hi, >> >> On Thu, Apr 17, 2008 at 09:43:22AM -0700, Ian Cox wrote: >> > Prior to 12.2(33)SXH netflow on the 6500 was enabled on a global >> > basis. Which is different to all the router platforms where it is >> > enabled on a per interface basis. In 12.2(33)SXH for the 6500 and >> > 12.2(33)SRA for the 7600 NDE was finally changed to be enabled on a >> > per interface basis like other cisco platforms. >> >> This is good news. >> >> I've heard different rumors on the actual implementation, though. So >> maybe >> you can clarify? >> >> One rumor was that SXH and SR* still have *all* flows in the netflow >> TCAM, >> and only filter on output, in the RP CPU. > > This is not how per interface works. Flows are only created in the > netflow table for interfaces it is enabled on. Interfaces without > netflow enabled drive a null flow mask and this results in no entries > being created in the netflow table for those interfaces. If you enable > nde on an interface this results in a non-null flow mask being used and > an entry being created in the table. > > > Ian - ----------------------------- hmm, so does that mean enabling netflow on the main interface and not sub-interface(s) won't collect netflow and /or populate netflow table for the sub-interface?
doing a quick test on my lab router 2800 running 12.4(10c) shows netflow collector gathering data from sub-interface w/ "ip route-cache flow" enabled on the main interface or am I confusing myself? sh ip cache flow shows traffic being sourced from sub-interface. regards, /virendra > >> Which would mean that this feature >> reduces the amount of data exported to the collectors, and the amount of >> processing needed there to filter wanted/unwanted interfaces (which is >> good), >> but that it would not reduce netflow TCAM contention, and possibly even >> increase RP CPU load. >> >> The second rumor is that SRC is actually filtering already upon >> *collection*, >> so that the TCAM usage and RP CPU load would dramatically go down if you >> only have netflow collection enabled on a few interfaces. >> >> >> Soooo... any truth in this? >> >> gert >> -- >> USENET is *not* the non-clickable part of WWW! >> >> //www.muc.de/~gert/ >> Gert Doering - Munich, Germany >> [EMAIL PROTECTED] >> fax: +49-89-35655025 >> [EMAIL PROTECTED] >> > > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFIB47HpbZvCIJx1bcRApCnAJ9T+GDuUZEx8isgfaLLWFBL8j/2YACeJ3WM kWRtXM2FsY9iqUVOp27YOlM= =07iN -----END PGP SIGNATURE----- _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
