On May 30, 2008, at 5:42 AM, Phil Mayers wrote:
We have a netflow collector from a Large Software Vendor on loan.
Said vendor waltzed in and coolly dropped into the conversation
"yeah we'll be needing you to drop your flow timers to 60 seconds,
including the "active flows" timer, else we won't get good results"
I was... less than impressed.
So I've been doing some statistical analysis of the distribution of
flow ages and packet counts; once i've got the results, how can I
predict the effect on CPU usage of a flow timer decrease?
there's a number of variables you should watch. please take the
following with a grain of salt YMMV, etc..
Depending on your export options, you will need to watch your SP cpu
utilization (as well as any DFCs). This may impact how responsive the
SNMP subsystem is. Don't utilize the software-based sampling. This
can drive the cpu load higher as well. You may see variations in
performance depending on software revisions as well as adjusting the
mls flow timers. Exporting the ASN data as well will cause additional
cpu hits, and with more aggressive flow timers, you should expect the
natural fallout from this.
- Jared
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
