Netflow - nature of incoming packet interval and flow aggregation intervals

[danny_fang_77]

Hi,

May I know what is the nature of Netflow packet arrival in relation to the Netflow’s flow record aggregation interval?

My understanding is that when the packets arrive from the collecting machine's receiving channels, it's packet would be filtered and processed, and flows filtered and aggregated.

But I'm not sure as to how are the flows being aggregated when there are incoming packets in a real time scenario. Are these packets firstly cached, and its flows aggregated later based on these cached packets?

Could anyone help me out with this question?

Thanks

Danny

[b.hsu]

see if the following link helps :

http://www.cisco.com/en/US/products/sw/netmgtsw/ps1964/products_implementation_design_guide09186a00800d6a11.html#wp1031105