| home | help | back | first | fref | pref | prev | next | nref | lref | last | post |
From: Roland Dobbins <rdobbins@arbor.net>
To: NANOG list <nanog@nanog.org>
In-Reply-To: <5a318d410907180305x4b924f1aoc883b2259c841878@mail.gmail.com>
Date: Sat, 18 Jul 2009 17:26:52 +0700
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Jul 18, 2009, at 5:05 PM, Darren Bolding wrote:
> Can someone provide a link, or more detail, on the netflow issues.
> Particularly as they relate to 6509's and sup720's.
mls table can hold 256K entries at 93% efficiency, so you end up with
about 239K flows total. No packet-sampled control of flow creation,
so the table is likely to be overflowed in production edge situations,
leading to non-deterministically skewed stats.
No logical OR of TCP flags throughout a TCP flow - can't classify SYN-
floods, RST-floods, et. al.
No stats on dropped traffic.
-----------------------------------------------------------------------
Roland Dobbins <rdobbins@arbor.net> // <http://www.arbornetworks.com>
Unfortunately, inefficiency scales really well.
-- Kevin Lawton
| home | help | back | first | fref | pref | prev | next | nref | lref | last | post |