North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: periodic patterns in juniper netflow exports

  • From: Roland Dobbins
  • Date: Thu Jan 03 07:09:25 2008
  • Authentication-results: hkg-dkim-1; [email protected]; dkim=pass ( sig from cisco.com/hkgdkim1002 verified; );
  • Dkim-signature: v=1; a=rsa-sha256; q=dns/txt; l=1028; t=1199361812; x=1200225812; c=relaxed/simple; s=hkgdkim1002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; [email protected]; z=From:=20Roland=20Dobbins=20<[email protected]> |Subject:=20Re=3A=20periodic=20patterns=20in=20juniper=20ne tflow=20exports |Sender:=20; bh=wxS0WCRGlqdTJR4t83EkmxFTmw1V+r4Br+09y5RdN/w=; b=oy42Moxx3eiW/gvpxwz6aDfMBpklNnqYAU1FOyAPciz9NTDxDkG9S8B3lN E6gcPvhtr+1dyvtwBs59/godraqIm9f6XZqslXpWUhaycFZQJPHpku04ogOm lbt2Oq7YouRQf1vOitjSytJMSSz0qKDx3vWERsEO4tlsAFZPZPcfk=;


On Jan 3, 2008, at 7:53 PM, Fernando Silveira wrote:

 The patterns I'm
talking about would imply an absolute clock (independent of any flow)
ticking every minute, and flushing the entire flow cache. The result
of this would be the binning effect I mentioned.

Yes, what you're describing is in fact different from the Cisco active flow timer. The Cisco active flow timer is set relative to the beginning of the flow, as you indicate, and not a system-wide purge of the entire cache (I didn't parse that properly in your initial query, apologies) on some sort of fixed-time basis.

There are folks involved in various NetFlow collection/analysis efforts on this list, I'm sure one of them or someone from Juniper will respond. juniper-nsp might also be a good place to ask.


-----------------------------------------------------------------------
Roland Dobbins <[email protected]> // 408.527.6376 voice

Culture eats strategy for breakfast.

-- Ford Motor Company