All,
We use nfdump/nfsen to gather our flows. The nfcap daemon writes the
flows to 5-minute-window files, the filename being the *start* of the
5-minute window.
If I look at e.g. nfcapd.200806041235 I see the following distribution
of flow *end* times:
732 2008-06-04 12:29
16492
12:36:00
12:37:00
...the flow should be exported at ~12:42 i.e. 300 seconds after the last
packet.
Many thanks,
Ben
-Original Message-
From: [EMAIL PROTECTED] on behalf of Phil Mayers
Sent: Wed 04/06/2008 12:53
To: cisco-nsp@puck.nether.net
Subject: [c-nsp] 6500 NDE aging
@puck.nether.net
Subject: [c-nsp] 6500 NDE aging prematurely
All,
We use nfdump/nfsen to gather our flows. The nfcap daemon writes the
flows to 5-minute-window files, the filename being the *start* of the
5-minute window.
If I look at e.g. nfcapd.200806041235 I see the following distribution
of flow *end
:00
...the flow should be exported at ~12:42 i.e. 300 seconds after the
last packet.
Many thanks,
Ben
-Original Message-
From: [EMAIL PROTECTED] on behalf of Phil Mayers
Sent: Wed 04/06/2008 12:53
To: cisco-nsp@puck.nether.net
Subject: [c-nsp] 6500 NDE aging prematurely
All,
We use
Ben Hicks wrote:
From
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6555/ps6601/prod_white_paper0900aecd80406232.html
-The NetFlow cache is constantly filling with flows and software in the
router or switch is searching the cache for flows that have terminated
or expired and
of Phil Mayers
Sent: Wed 04/06/2008 12:53
To: cisco-nsp@puck.nether.net
Subject: [c-nsp] 6500 NDE aging prematurely
All,
We use nfdump/nfsen to gather our flows. The nfcap daemon writes the
flows to 5-minute-window files, the filename being the *start* of the
5-minute window.
If I look at e.g
