We have a netflow collector from a Large Software Vendor on loan.
Said vendor waltzed in and coolly dropped into the conversation "yeah
we'll be needing you to drop your flow timers to 60 seconds, including
the "active flows" timer, else we won't get good results"
I was... less than impressed.
So I've been doing some statistical analysis of the distribution of flow
ages and packet counts; once i've got the results, how can I predict the
effect on CPU usage of a flow timer decrease?
So I'm thinking of effects like; with the timers at defaults (no fast
aging, 5 minutes inactive, 30 minutes active) how often does the CPU
walk the netflow tcam? How long does a walk take? Will there be locking
or contention issues?
The box has sup720 PFC/DFC-3Bs and the netflow TCAM never overflows.
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
