Purview Sizing / Flows

  • 0
  • 1
  • Question
  • Updated 3 years ago
  • Answered
Hi,

could someone point me to the right documents regarding purview sizing? I remeber some excel sheet to calculate flows....
I got a NMS ADV running with the 3000 fpm included license. Where would i check in my history data? The dashboards counter shows millions of flows - but is this a value for licensing?
Photo of mp2014

mp2014

  • 1,270 Points 1k badge 2x thumb

Posted 3 years ago

  • 0
  • 1
Photo of aloeffle

aloeffle

  • 980 Points 500 badge 2x thumb

Hi mp2014.

you can calculate 30 flows / endsystem.

But I have currently no document which describes this.

regards

Alex

Photo of Mike Thomas

Mike Thomas, Employee - GTAC - NMS

  • 7,650 Points 5k badge 2x thumb
This is usually delivered as a professional service engagement by Extreme. It takes some time to do it effectively.

But in essense,
One takes a trace at the point of the Netflow collector interface (assuming it's online, if not, any IP to a PC will do, send Netflow to that IP address of the sniffer)
Start filtering Netflow on port udp 2055. Each netflow packet generally has 20+ flows in it (expand it to look at it). Capture a minutes worth of traffic. Do this several times through the day, at peak traffic periods. This will give a general idea of the effective average flow rate in a one minute span, assuming the flows are being delivered within a one minute interval, which is generally the case.

If your using a Extreme PV-FC-180 or S-Series device, you can also look at the commands samples at a one minute interval

loop 5 60
show flow stat
This command shows all flows unique to a port. With uplinks, there is likely overlap you would want to avoid when enabling Netflow. Generally you want to set to rx only on a port.
Also,

loop 5 60
show netflow stat

This shows the amount of packets that are able to be exported over a minutes timeframe.

The loop command ask for 5 samples at 60 second intervals, and will print the data to the screen. Use 'set length 0' first if your paging is enabled. Capture all data to a log buffer for later review.
Photo of mp2014

mp2014

  • 1,270 Points 1k badge 2x thumb
thanks for explaning, that sheds some light to it - and brings up another problem.
We use S-Series switches, netflow data send to NMS as collector (all Ports) and additionally to purview appliance. But I guess its impossible to use different amount of included ports for 2 netflow destinations on same device (pureview needs netflow data from one specific port only). So pureview will see much more flows (according to netflow data) than necessary, but would count this for licensing.
Possible to address this somehow? Or do I need to resign on the netflow data sent to NMS?