Hi all,
I'm have configured netflow and using it for some time on ASR9001, but i have a few questions that always appear and I don't have any answers:
I need to know the actual limits of the netflow engine on ASR9001. I have read Alexanders Thuijs post "ASR9000/XR Netflow Architecture and overview" which is an excellent post but I still need a few things clarified.
I'd like to understand the following:
1. Alexander says that netflow limit "Typhoon: 200kpps/LC". What exaclty is the 200Kpps.
Possible answers:
a) Is it normal traffic packets passing by an interface with netflow enabled? Does this mean that the netflow engine can only examine 200kpps of real traffic and if i have more, i need to sample it?
b) the 200kpps is refering to new cache entries created? Does this mean that packets that belong to flows that are already cached, don't count for the 200Kpps limit?
c) the 200kpps is refering to the export capability in netflow packets and has nothing to do with actual traffic packets.
d) something else
2. Is the netflow cache creation/update a hardware function? If i create a flow monitor *without* an exporter, with 1:1 sampling and enable it on a 100 interfaces/subinterfaces,in and out and pass 40G traffic, will the box collapse or increase its CPU usage? Don't try to convince me that there is not point in such a config, because I agree. I'm trying to understand the limits/impact, as I said.
3. when i 'sh flow monitor-map flm-input', it says 'CacheRateLimit: 2000'.
Does this mean that the netflow cannot create more than 2000 new entries/sec? If not, what does it mean?
I think this is enough for now.
Cheers,
Spiros
