Netflow Best Practices

[Thomas Yarger]

All, 

I have a customer using PRTG as their monitoring tool/collector and their network has limited bandwidth. I wanted to know if there are any documents relating to fine tuning timeouts/caching/TTL's? I couldn't find any that addressed my concerns. The configuration I've been using is below. Thanks! Best. 

!
flow record PRTG
description Netflow Record
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
collect transport tcp flags
collect counter bytes long
collect counter packets long
!
!
flow exporter PRTG
description Export to PRTG
destination 192.168.0.165
source Vlan1
transport udp 2055
!
!
flow monitor PRTG
description Netflow Monitor
exporter PRTG
record PRTG
!
!
sampler PRTG
description Netflow Sampler
mode random 1 out-of 50
!

[casanavep · Accepted solution]

Are they trying to graph via NetFlow for realtime usage graphing, then be able to drill into those graphs? If so, make you cache timeouts 60 seconds: 

FNF Exporters set to:  template data timeout 60

FNF Monitors set to:  cache timeout active 60

These are the settings I typically utilize.  If not, utilization can be really off from reality when looking at flow graphs.

Cheers,

--Pete

[Thomas Yarger]

Hey Pete,

Can you elaborate on what each of those timeouts are for? I’m trying to better understand the nuts & bolts of Netflow.

Thanks again!