On 04/07/11 15:59, [email protected] wrote:
This seems to be having the desired affect in that TCAM utilisation is not
approaching 100% and there doesn't appear to have been any significant
increase in CPU utilisation (the EARL NDE task pops up in the process list
on occasion when I check but seems to be using single figure % on the
whole).
That's what we see; slight but largely insignificant CPU increase.
However, my question is whether there are any disadvantages to aggressive
aging, i.e. am I potentially missing flow information or exporting
incomplete flow information by moving away from the default settings and
aging flows quicker?
The flow information should be complete; you shouldn't miss anything.
What you might see is >1 flow for some connections, if they have mixed
periods of activity and inactivity e.g. if the host stops sending
packets for 33 seconds, then re-starts, you'll see two flows with the
same source/dest IPs/ports.
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
