Netflow top-talkers

[khaled.ahmed]

Hi,

I have Netflow Top-Talkers configured on couple of devices for the top 10 and sorted by Bytes, the results of “sh ip flow top-talkers” command shows the amount of Bytes but I could not determine if this amount was the average in 5 seconds or the total or what? Does anyone have an idea of how can I find out how much traffic is going across?

Thanks,

Khaled

[chuckwirth]

The amount of bytes is the total number of bytes for 5 seconds which is the default time that NetFlow holds the information. To do a rough calculation of bandwidth multiply Bytes by 8/5 to get bits/second.

You might try a commercial software application to diplay and store the information better. The second link has lots of suggestions. I have used ManageEngine before (limited use is free) and included the link at the bottom.

cache-timeout

To specify the length of time for which the list of NetFlow top talkers (unaggregated top flows) is retained, use the cache-timeout command in NetFlow top talkers configuration mode. To return the timeout parameters for the list of top talkers to the default of 5 seconds, use the no form of this command.

cache-timeout milliseconds

no cache-timeout

Syntax Description

milliseconds

Length in milliseconds for which the list of top talkers is retained. The range is from 1 to 3,600,000 (1 millisecond to one hour). The default is 5000 (5 seconds).

Reentering the top, sort-by, or cache-timeout command resets the timeout period, and the list of top talkers is recalculated the next time they are requested.

•The list of top talkers is lost when the timeout period expires. You should configure a timeout period for at least as long as it takes the network management system (NMS) to retrieve all the required NetFlow top talkers.

•If this timeout value is too large, the list of top talkers might not be updated quickly enough to display the latest top talkers. If a request to display the top talkers is made more than once during the timeout period, the same results will be displayed for each request. To ensure that the latest information is displayed while conserving CPU time, configure a large value for the timeout period and change the parameters of the cache-timeout, top, or sort-by command when a new list of top talkers is required.

http://www.cisco.com/en/US/products/sw/iosswrel/ps1838/products_feature_guide09186a0080259533.html#wp1134500

http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6555/ps6601/prod_white_paper0900aecd80406232.html

http://manageengine.adventnet.com/products/netflow/download.html

[Chad Parish]

Quick question, so with Netflow Top-Talkers, I need to configure just the layer3 interfaces of my routers and L3 switches (i.e. Loopback interfaces, serial interfaces and VLAN interfaces)?

Also, when attempting to sort by bytes on a VLAN SVI it only allows me to choose sorting by packets, why is this?