S/N/K-Series recommended Netflow Settings

[FAQ_User]

Article ID: 13584

Products
S-Series
Matrix N-Series DFE
K-Series

Solution
The default Netflow settings are those identified by the Netflow standard. These are:Template Timeout: 30 (minutes) [time between collector start and template receipt]
Template Refresh-rate: 20 (packets) [netflow packets sent between template refreshes]
Export-interval: 30 (minutes) [how often to send data on active flows]The recommended Netflow settings are for optimized traffic flow. These are:Template Timeout: 1 (minute - minimum supported)
Template Refresh-rate: 600 (packets - maximum supported)
Export-interval: 1 (minute - minimum supported)The commands for implementing the recommended settings are:set netflow template refresh-rate 600 timeout 1
set netflow export-interval 1Notes:

• Setting the Template Timeout to 1 minute ensures that the system will send out a template construct once per minute, telling the collector how packets are to be displayed. Using the default of 30 minutes could lead to a 30-minute delay before any data is presented by the collector, and a message similar to this may appear on the collector:

  7/18/2012 11:07 AM NetFlow Receiver Service [chiana] received NetFlow V9 flows without any template for decoding them. Configure the device 10.26.192.108 to export an appropriate NetFlow V9 template at 1-minute intervals. See help for details.

• Setting the Template Refresh-rate to 600 packets provides for less overhead for the Netflow-capable device and for the Netflow collector.
• Setting the Export-interval to 1 minute makes the collector's data appear in granular 1 minute intervals, allowing for a more detailed analysis of network traffic patterns.
• The Inactive-timer is set to 40 seconds, neither viewable nor configurable. If a flow has not been updated within that period of time by a real packet traveling through the switch, the switch will stop accumulating that Netflow record and will send it along to the collector.

See also: 7485.