I have a small question. We use Netflow for monitoring bandwidth usage for our WAN links. But i found some difference in counters and netflow data. This raises the question of whether, how Cisco IOS perform packet processing. Especially interesting order of operation which are perform when packet enter to the interface and goes out from out interface. I found this document http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080133ddd.shtml
but there no information about when creates netflow packet. If it important we use 3845 and 28xx series routers.