Hi Everybody
Has anybody had any real world experiences running time based sampling on a 7600 as a way to still be able to extrapolate traffic through the box even if the TCAM cache fills up? >From what I've read in the documentation, if you configure say a time based sampling rate of 1024, it simply exports the first 4ms of every 4096ms window (router actually says 8 in 8192). Hence, if the cache fills up within the export interval, you can still multiple by the sampling rate and get something rather accurate. I've tested this in a lab environment with 25kflows/sec of non-bursty traffic, (ie, not even filling the TCAM in the 8192ms window) and the netflow records are way way out. However if I change to packet based sampling, they're 99% accurate (That is until flows/sec increase and fill the TCAM of course..) Thanks Andrew This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. _______________________________________________ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/