V8 Aggregation Cache

Answered Question
Mar 17th, 2010

What is a

V8 Aggregation Cache?  I am reading my Operator's Manual for our NM-NAM, and it goes into some discussion under the "Monitoring Data" section about NDE Flow Masks and V8 Aggregation Caches.  I am not sure what the V8 Aggregation Cache is.

Our equipment is 3750 switches and 3800 series routers.  Do I need to configure or can i configure V8 Aggregation Caches on them?  What would be the benefit of such?

Thanks

Kevin

I have this problem too.
0 votes
Correct Answer by yjdabear about 6 years 10 months ago

Looks like the NAM only supports 4 out of the 5 possible NetFlow v8 aggregation types:

http://www.cisco.com/en/US/docs/ios/solutions_docs/netflow/nfwhite.html#wp1061627

• Aggregated v5 flows.
• Much less data to post process, but
loses fine granularity of v5 – no IP
addresses.

http://nsrc.org/workshops/2009/apricot/netmanage/presos/netflow-slides.pdf

In my limited world, I haven't heard of anyone using v8.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
Correct Answer
yjdabear Thu, 03/18/2010 - 09:26

Looks like the NAM only supports 4 out of the 5 possible NetFlow v8 aggregation types:

http://www.cisco.com/en/US/docs/ios/solutions_docs/netflow/nfwhite.html#wp1061627

• Aggregated v5 flows.
• Much less data to post process, but
loses fine granularity of v5 – no IP
addresses.

http://nsrc.org/workshops/2009/apricot/netmanage/presos/netflow-slides.pdf

In my limited world, I haven't heard of anyone using v8.

Kevin Melton Thu, 03/18/2010 - 10:29

Bear

Your answer did help out though.  I did not know that "V8" stood for version 8 of Netflow. 

I had not heard of that before until examining configuration options on the NAM.

Looks like one would loose alot of important data.  I wonder what a practical example would be of why someone would ever implement it...

Anyhow Thanks!

Kevin

yjdabear Thu, 03/18/2010 - 10:44

Here's a tool that works exclusively with NetFlow v8 (and sFlow) data:

https://neon1.net/as-stats/

Its Readme kinda sums up what v8 records can be useful for:

"How it works
------------

A Perl script (netflow-asstatd.pl) collects NetFlow v8 AS aggregation records
or sFlow v5 samples from one or more routers. It caches them for about a
minute (to prevent excessive writes to RRD files), identifies the link that
each record refers to (by means of the SNMP in/out interface index), maps it
to a corresponding "known link" and RRD data source, and then runs RRDtool. To
avoid losing new records while the RRD files are updated, the update task is
run in a separate process.

For each AS, a separate RRD file is created as needed. It contains two data
sources for each link - one for inbound and one for outbound traffic.
In generated per-AS traffic graphs, inbound traffic is shown as positive,
while outbound traffic is shown as negative values.

Another Perl script, rrd-extractstats.pl, is meant to run about once per hour.
It sums up per-AS and link traffic during the last 24 hours, sorts the ASes
by total traffic (descending) and writes the results to a text file. This
is then used to display the "top N AS" and other stats by the provided PHP
scripts."

Actions

This Discussion