[88482] in North American Network Operators' Group
Re: Interesting netflow entry
daemon@ATHENA.MIT.EDU (Bill Nash)
Tue Feb 7 13:29:09 2006
Date: Tue, 7 Feb 2006 13:21:15 -0500 (EST)
From: Bill Nash <billn@odyssey.billn.net>
To: Wil Schultz <wschultz@wilcomm.net>
Cc: nanog@nanog.org
In-Reply-To: <43E7EA29.3000500@wilcomm.net>
Errors-To: owner-nanog@merit.edu
On Mon, 6 Feb 2006, Wil Schultz wrote:
>> Incidentally (because I ask everyone this), what's your flow volume (flows
>> per second)?
>>
> Cannot get ahold of the machine until tomorrow. I did a 'wc' on 4 devices for
> 5 minutes and it comes out to just under 3600, about 11-12 per second...
>
Erm, that seems kind of low. Flow volume for two 6509s in what I consider
a small to medium size hosting site, with about 6+ gigs of differentiated
egress generates more than 8 to 9 *thousand* flows per second, and that's
after discard incomplete tcp flows (port scans, half open syns, etc.)
Are you sure you're getting everything?
- billn
