S/N/K-Series recommended Netflow Settings


Userlevel 3
Article ID: 13584

Products
S-Series
Matrix N-Series DFE
K-Series

Solution
The default Netflow settings are those identified by the Netflow standard. These are:Template Timeout: 30 (minutes) [time between collector start and template receipt]
Template Refresh-rate: 20 (packets) [netflow packets sent between template refreshes]
Export-interval: 30 (minutes) [how often to send data on active flows][/code]The recommended Netflow settings are for optimized traffic flow. These are:Template Timeout: 1 (minute - minimum supported)
Template Refresh-rate: 600 (packets - maximum supported)
Export-interval: 1 (minute - minimum supported)[/code]The commands for implementing the recommended settings are:set netflow template refresh-rate 600 timeout 1
set netflow export-interval 1[/code]Notes:
  • Setting the Template Timeout to 1 minute ensures that the system will send out a template construct once per minute, telling the collector how packets are to be displayed. Using the default of 30 minutes could lead to a 30-minute delay before any data is presented by the collector, and a message similar to this may appear on the collector: [code]7/18/2012 11:07 AM NetFlow Receiver Service [chiana] received NetFlow V9 flows without any template for decoding them. Configure the device 10.26.192.108 to export an appropriate NetFlow V9 template at 1-minute intervals. See help for details.[/code]
  • Setting the Template Refresh-rate to 600 packets provides for less overhead for the Netflow-capable device and for the Netflow collector.
  • Setting the Export-interval to 1 minute makes the collector's data appear in granular 1 minute intervals, allowing for a more detailed analysis of network traffic patterns.
  • The Inactive-timer is set to 40 seconds, neither viewable nor configurable. If a flow has not been updated within that period of time by a real packet traveling through the switch, the switch will stop accumulating that Netflow record and will send it along to the collector.
See also: 7485.

0 replies

Be the first to reply!

Reply