North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Netflow problem

  • From: Simon Leinen
  • Date: Thu Apr 13 17:13:33 2000

>>>>> "ylt" == Yannick Le Teigner <[email protected]> writes:
> I have a little problem setting up Netflow on routers.
> It seems like the timeout to remove unactive flow from the cache is too
> low(15"), and I can't set it to a bigger value (say 5 minutes).

Given a recent enough IOS, you can use

swiCE1(config)#ip flow-cache timeout inactive ?
  <10-600>  Timeout in seconds

> A good example is the bgp session. Depending on the time I execute a
> "show ip cache flow", the bgp session is seen active or not,
> although it is always active!

Maybe your routes don't flap enough, otherwise there would always be
update activity keeping the flow active.  Do you use route dampening?
Just kidding.

> The problem is that if the router doesn't see any data on a flow
> during 15 seconds, it considers it unactive.

If you set the inactive timeout too high, you will probably keep a lot
of obsolete flows in the NetFlow cache.  This may cause the cache to
fill up (note that you can also configure the size of that cache in
recent IOS versions), maybe causing additional cleanup overhead.

> I included two outputs of "show ip cache flow" to show you the problem.

Well, is this really a problem for you? You can always use e.g. the
SNMP tcpConnTable and the BGP-4 MIB to get very detailed information
about BGP connections terminating at the router.