[101408] in North American Network Operators' Group
Re: periodic patterns in juniper netflow exports
daemon@ATHENA.MIT.EDU (Roland Dobbins)
Thu Jan 3 07:08:35 2008
From: Roland Dobbins <rdobbins@cisco.com>
To: NANOG <nanog@merit.edu>
In-Reply-To: <d9524e220801030353q66a1d088y19e4e0646310edfa@mail.gmail.com>
Date: Thu, 3 Jan 2008 20:03:32 +0800
Errors-To: owner-nanog@merit.edu
On Jan 3, 2008, at 7:53 PM, Fernando Silveira wrote:
> The patterns I'm
> talking about would imply an absolute clock (independent of any flow)
> ticking every minute, and flushing the entire flow cache. The result
> of this would be the binning effect I mentioned.
Yes, what you're describing is in fact different from the Cisco active
flow timer. The Cisco active flow timer is set relative to the
beginning of the flow, as you indicate, and not a system-wide purge of
the entire cache (I didn't parse that properly in your initial query,
apologies) on some sort of fixed-time basis.
There are folks involved in various NetFlow collection/analysis
efforts on this list, I'm sure one of them or someone from Juniper
will respond. juniper-nsp might also be a good place to ask.
-----------------------------------------------------------------------
Roland Dobbins <rdobbins@cisco.com> // 408.527.6376 voice
Culture eats strategy for breakfast.
-- Ford Motor Company
