Netflow overhead

[poulid]

Hello. We have about 60 offices spread across Canada, which all connect back to our head office via an MPLS network. For the most part, everything works great, not many complaints from users. Our offices range from T1 speed to 10Mb. Every now and then we hear complaints that things are slow out in an office, but without Netflow info available at that instant, all we can tell the user is that the line is being heavily utilized. By the time we call the provider and have them turn on Netflow, the traffic spike has subsided.

So, this brings me to my question; would it make sense to have the provider turn on Netflow on every router, and send all of the info back to a Netflow server at head office? I was wondering what type of overhead this would put on the connections coming into head office?

Thanks in advance.

[rnieuwhof]

We have a similar wan topology. Netflow overhead is not that large. We invested in a netflow product and run it 24x7 and it is nice to have it at our fingertips.

I recommend it highly.

[yagnesh_tel]

I would rather watch CPU utilization on devices after netflow implementation than monitoring bandwidth usage considering minimum T1 speed in your network. Netflow is a bit cpu intensive process. I am not able to find any Cisco document that suggest expected netflow overhead but we have more than 300 devices with netflow enabled and didn't observe any noticeable increase in bandwidth utilization after enabling netflow.