![]() The potential problem with an active timeout of 5 minutes: If the reporting tool expects the data in 1 minute intervals, spikes greater than 100% utilization will likely be displayed in the data trend. every five minutes), a flow that lasts 2 or 3 minutes could get its data exported all at once. Alternatively, if the active timeout is configured for a longer interval (e.g. The flow entry is also removed from the flow cache. In the fifth minute, the flow would end and the remaining delta bytes and packets with the flow are exported. For example, if a connection or flow to download a file takes 4.5 minutes, the delta byte count would export the contents of the flow record every 60 seconds. ![]() Generally this is set to 60 seconds as most reporting tools like to report on data with a granularity of 1 minute intervals. ![]() The active timer expires for long-lived flows.This article explains how and why flows are exported.Ĭonventional network traffic entries in the flow cache table are exported when one of four events occur: ![]() Without this command entered into the NetFlow configuration, the trends will likely be overstated and understated at times. Secondly, if it was a network traffic trend using NetFlow that you were looking at, you may want to verify that the command ip flow-cache timeout active 1 had been configured on the Cisco router. Have you ever been monitoring network traffic and been suspicious of NetFlow overstating utilization? The first thing to consider is the interface speed, is it set correctly as generally this information is pulled from the device using SNMP and sometimes the interface speed is set incorrectly. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |