What overhead from IP Accounting?

[cyberpete]

We have a 500 user+ network and sometimes it helps to determine the endpoints of large traffic flows (helps us to determine what apps and servers are eating bandwidth - or if any unusual patterns ie virus etc). I tend to use ip accounting to gather source/dest packet info. Does anyone have a definitive(ish) explanation of the resource hit (if any) on a Cisco router in undertaking this task? (Routers are typically MSFC 6509 running CEF, and some 35xx and 29xx series models). I tend not to run IP Accounting for too long but would have longer samples if I didn't think it would hurt the router. We cant afford NetFlow either

;-(

Thanks Peter

[Georg Pauwen]

Hello Peter,

the resource use is directly proportional to the amount of packets, because with IP accounting configured, all packets need to go through the router processor. In my experience, IP accounting increases the CPU load at an average of 2% to 4%, but that is not documented anywhere. I have not experienced IP accounting to bog down anything, and sometimes even forgot to turn it off, without anybody complaining.

I guess the best idea is to monitor the utilization when using IP accounting, and to implement some warning mechanisms, such as RMON...

HTH,

GP