I am looking to get some guidance on some good NetFlow parameters to enter on a production network such as cache timeout, sampler numbers, template data time-outs, etc. I would say I want to be sure not to use up much CPU or cause any type of excess bandwidth usage or something. This is what I have got so far in my VIRL lab:
feature netflow
flow exporter flowex1
description exportversion9
destination 192.0.2.1
transport udp 200
source Ethernet2/1
version 9
template data timeout 1200
option exporter-stats timeout 1200
flow exporter FlowExp
description FlowExp_CE_Sw1
destination 192.168.1.217
transport udp 2055
source Ethernet2/1
version 9
template data timeout 1200
option exporter-stats timeout 1200
flow record TEST
description IPv4Flow
match ipv4 destination address
match ip protocol
match ip tos
match transport destination-port
collect transport tcp flags
collect counter bytes
collect counter packets
collect timestamp sys-uptime last
collect ip version
flow record TEST_l2record
match datalink ethertype
flow record FlowRec
description CE_Sw_FlowRec
match transport destination-port
collect counter packets
sampler Flow_Sampler
description Flow_Sampler_CE_Sw1
mode 1 out-of 100
flow monitor flowmon1
description IPv4Mon
record TEST
exporter flowex1
flow monitor FlowMon
description FlowMon_CE_Sw1
record FlowRec
exporter FlowExp
interface Vlan10
ip flow monitor FlowMon input
interface Vlan11
ip flow monitor flowmon1 input
