Are there any disadvantages to aggressive netflow aging?
I've enable netflow across the bulk of our 6509 estate and have, after reading various guides, posts and pieces of advice settled on a fairly aggressive set of mls aging timers:-
mls aging long 64
mls aging normal 32
mls aging fast time 16
This seems to be having the desired affect in that TCAM utilisation is not approaching 100% and there doesn't appear to have been any significant increase in CPU usage (the EARL NDE task seems to be using single figure % on the whole).
My question is around whether there are any disadvantages of aggressive aging, i.e. am I missing information by moving away from the default settings and aging flows quicker?
netflow tuning is similar to QoS tuning meaning that there is no setting which is good for every implementation but it depends on traffic pattern and on the hardware being utilized.
In general you use fast aging when TCAM is getting full and you need to clear space to fit more flows and get more accurate information (if the TCAM is full new flows are not created).
The drawback is that the shorter the flows stay in the TCAM and 'statistically' the higher the CPU will go as in a unit of time it needs to create and delete an higher number of flows (and depending on hw and configuration it might export them to a collector).
If you don't see high CPU condition when you configure a more aggressive aging it means that 1) your hardware can cope with the traffic pattern and 2) there aren't some many new unique flos created in a unit of time.
Have you ever wondered why pluggable optics exist? Have you ever wondered what acronyms like QSFP, LR4, FEC, and PAM4 actually mean? In this episode I continue my conversation with my colleague Ray Nering. He explains to me how a lot of these came to be, ...
Community Live- Smart Licensing Using Policy (Routing) – A Simplified Licensing Approach
(Live event - Tuesday, 18 May, 2021 at 9:00 am Pacific/ 1:00 pm Eastern / 7:00 pm Paris)
This event will have place on Tuesday 18th, May 2021 at 9:00 hrs PDT&nb...
Today I'm going to write SD-WAN Overview & Advanced Deployment Lab Part ||* check out SD-WAN Overview & Advanced Deployment Lab Part | through this link : https://community.cisco.com/t5/networking-documents/sd-wan-overview-amp-advan...
Have you ever wondered why pluggable optics exist? Have you ever wondered what acronyms like QSFP, LR4, FEC, and PAM4 actually mean? In this first episode I start a conversation with my colleague Ray Nering. He explains to me how a lot of these came to be...
Support Talks video- How to determine a legitimate hardware issue
(Live event - Thursday 13 May, 2020 at 9:30 am Pacific/ 12:30 pm Eastern / 6:30 pm Paris)
This event had place on Thursday 13th, May 13 at 9:30hrs PST
This event helps you to ...