> -----Original Message----- > From: Paul Aitken (paitken) > Sent: Monday, June 16, 2008 10:17 AM > To: [EMAIL PROTECTED] > Cc: Roland Dobbins (rdobbins); cs-netflow (mailer list); > [email protected] > Subject: Re: Fwd: [c-nsp] Netflow v9 - sampling and IOS > > Peter, > > > Hi Cisco gurus, For the next developing steps for my nfdump > tools, I > > would like to implement sampling - a feature, which a lot of users > > would like to have. Sampling for v5 is announced in the v5 > header and > > therefore easy to recognize. > > No it's not. > > 3 bits of v5 sampler ID are hacked into the padding at the > end of the v5 data records. This isn't available on all > platforms, and isn't officially supported in the netflow v5 protocol. > > > > For v9, the tags 34 and 35 (SAMPLING_INTERVAL and SAMPLING_ALGORITHM > > ) are defined in the specs, but it seams as the IOS does not export > > sampling information using these tags. > > Correct. I don't see them being used anywhere in our code.
I believe they are still used in 12.0S on c12000 aka GSR. -D > > > > Googling lots of CISCO papers does not reveal more > information on this > > issue. So can anybody shed some light on the question how IOS > > announces sampling in v9? Which platform/IOS combination do work or > > are required to get sampling information in the netflow records? > > In v9 export, there's a sampler option which contains the > following fields: > > FLOW_SAMPLER_ID #48 > FLOW_SAMPLER_MODE #49 > FLOW_SAMPLER_RANDOM_INTERVAL #50 > > The sampler ID is also provided in the v9 IPv4 record. > > Unfortunately this information isn't available in the netflow > v5 export format. > > -- > Paul Aitken > Cisco Systems Ltd, Edinburgh, Scotland. > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
