cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1206
Views
0
Helpful
2
Replies

NetFlow V9 sampling and missing sampler ID field

linker.team
Level 1
Level 1

In NetFlow v9, I am not able to see the flow sampler ID in the data flowsets. Am I missing any configuration? However option templates reports the right sampling type and interval and flow sampler id. Is this a bug?

My Cofiguration:

interface FastEthernet0/0

description $ETH-LAN$

ip address 192.168.118.32 255.255.255.0

ip nbar protocol-discovery

duplex auto

speed auto

flow-sampler nfa

service-policy input sample

service-policy output Stream

!

interface FastEthernet0/1

description FastEthernet0/1

ip address 192.168.10.90 255.255.255.0

ip nbar protocol-discovery

duplex auto

speed auto

flow-sampler nfa

service-policy input sample

service-policy output sample

--------------------------------------------

cisco2811#sh flow-sampler

Sampler : nfa, id : 1, packets matched : 48811, mode : random sampling mode

sampling interval is : 100

cisco2811#

-------------------------------------------------

cisco2811#sh run | incl flow

flow-sampler-map nfa

flow-sampler nfa

flow-sampler nfa

ip flow-export version 9

ip flow-export template options export-stats

ip flow-export template options sampler

ip flow-export template options refresh-rate 1

ip flow-export template refresh-rate 1

ip flow-export destination 192.168.112.152 9996

ip flow-export destination 192.168.112.83 9996

cisco2811#

2 Replies 2

owillins
Level 6
Level 6

No sampler_id is present in the aggregation template coming from a GSR

Sampling is global on a GSR and as such there's only one sampling rate

for the whole box. GSR netflow DE's decided that no sampler id is needed in that case as the sampling rate in the options data template is the same for all the flows.

The reason that you don't see a sampler_id in the aggregation template is because the sampling on a GSR can only be enabled 'globally' (= the same for the whole box). Why there's a sampler_id in the normal, non-aggregated, templates. That they always fill in '0' in this field and don't use it. To find out the sampling-rate, you can use the options data that is sent by the GSR and apply it to all the flows that are sent from this GSR.

Thank you for your reply. Actually there is no one sampling interval for the whole box. We can configure more than one sampler map in the box with various sampling rates to different interfaces. And I can see the sampler ID in the options dataset but not in the data flows. Sampler Id seems to be the unique field to identify the sampling rate itherwise each flow record has to be checked with the entire options flow set with the matching interface information to scale the sampled flows.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: