[33426] in North American Network Operators' Group
Re: Traffic Analizer
daemon@ATHENA.MIT.EDU (Robert Beverly)
Wed Jan 10 12:04:30 2001
Date: Wed, 10 Jan 2001 11:50:50 -0500
From: Robert Beverly <rbeverly@rbeverly.net>
To: nanog@merit.edu
Message-ID: <20010110115050.A1246@rbeverly.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Errors-To: owner-nanog-outgoing@merit.edu
Junipers with Internet Processor IIs and JunOS >= 4.2 also support
exporting netflow records (version 5 or 8). Unfortunately they do it
by sampling each Nth packet (where N is configurable) and sending to
the SCB (the juniper routing engine). The connection to the SCB is
only 100Mb while the router supports much higher speed interfaces, so
we have had to use low sampling rates to avoid saturating the SCP
connection. In practice we optically split trunks and use passive
monitors (up to OC12, working on OC48).
http://www.juniper.net/techpubs/software/junos42/swconfig-interfaces42/html/sampling-config.html
rob
On Tue, Jan 09, 2001 at 11:15:14PM -0500, jlewis@lewis.org wrote:
>
> On Tue, 9 Jan 2001, Chris Adams wrote:
>
> > > NetFlow and related tools. Cisco's own NetFlow and CAIDA's cflowd tools
are
> > > the two I'm familiar with.
> > >
> > > <URL:http://www.cisco.com/warp/public/732/Tech/netflow/>
> > > <URL:http://www.caida.org/tools/>
> >
> > What kind of additional load (CPU, RAM) does NetFlow put on a router
> > (say a 7505 or 7513)? How does it work with CEF (along side it or in
> > place of it)?
>
> I recently turned it off on one of our 7206's where it was using about 6mb
> of RAM and increasing the CPU load by about 20 points. 128mb doesn't go
> as far as it used to.
