From Cisco http://cisco.com/en/US/products/sw/netmgtsw/ps1964/products_implementation_design_guide09186a00800d6a11.html
Rules for expiring NetFlow cache entries include: •Flows which have been idle for a specified time are expired and removed from the cache •Long lived flows are expired and removed from the cache (flows are not allowed to live more than 30 minutes by default, the underlying packet conversation remains undisturbed) •As the cache becomes full a number of heuristics are applied to aggressively age groups of flows simultaneously •TCP connections which have reached the end of byte stream (FIN) or which have been reset (RST) will be expired. Expired flows are grouped together into "NetFlow Export" datagrams for export from the NetFlow-enabled device. NetFlow Export datagrams may consist of up to 30 flow records for version 5 or 9 flow export. [EMAIL PROTECTED] wrote on 09/05/2007 07:39:08 PM: > > Hi，I have a question. Can you help me? > I want to know how one record is created? that is to say, what is > the condition to create a udp packet to end the flow records and set > it to the collecter of Netflow? > Thanks very much. > > lijian > 2007-09-05_______________________________________________ > Flow-tools mailing list > [EMAIL PROTECTED] > http://mailman.splintered.net/mailman/listinfo/flow-tools
_______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
