V8 Aggregation Cache

Answered Question
Mar 17th, 2010
User Badges:

What is a

V8 Aggregation Cache?  I am reading my Operator's Manual for our NM-NAM, and it goes into some discussion under the "Monitoring Data" section about NDE Flow Masks and V8 Aggregation Caches.  I am not sure what the V8 Aggregation Cache is.

Our equipment is 3750 switches and 3800 series routers.  Do I need to configure or can i configure V8 Aggregation Caches on them?  What would be the benefit of such?


Thanks

Kevin

Correct Answer by yjdabear about 7 years 2 months ago

Looks like the NAM only supports 4 out of the 5 possible NetFlow v8 aggregation types:

http://www.cisco.com/en/US/docs/ios/solutions_docs/netflow/nfwhite.html#wp1061627


• Aggregated v5 flows.
• Much less data to post process, but
loses fine granularity of v5 – no IP
addresses.

http://nsrc.org/workshops/2009/apricot/netmanage/presos/netflow-slides.pdf


In my limited world, I haven't heard of anyone using v8.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
Correct Answer
yjdabear Thu, 03/18/2010 - 09:26
User Badges:
  • Gold, 750 points or more

Looks like the NAM only supports 4 out of the 5 possible NetFlow v8 aggregation types:

http://www.cisco.com/en/US/docs/ios/solutions_docs/netflow/nfwhite.html#wp1061627


• Aggregated v5 flows.
• Much less data to post process, but
loses fine granularity of v5 – no IP
addresses.

http://nsrc.org/workshops/2009/apricot/netmanage/presos/netflow-slides.pdf


In my limited world, I haven't heard of anyone using v8.

Kevin Melton Thu, 03/18/2010 - 10:29
User Badges:

Bear


Your answer did help out though.  I did not know that "V8" stood for version 8 of Netflow. 

I had not heard of that before until examining configuration options on the NAM.


Looks like one would loose alot of important data.  I wonder what a practical example would be of why someone would ever implement it...


Anyhow Thanks!


Kevin

yjdabear Thu, 03/18/2010 - 10:44
User Badges:
  • Gold, 750 points or more

Here's a tool that works exclusively with NetFlow v8 (and sFlow) data:

https://neon1.net/as-stats/


Its Readme kinda sums up what v8 records can be useful for:


"How it works
------------


A Perl script (netflow-asstatd.pl) collects NetFlow v8 AS aggregation records
or sFlow v5 samples from one or more routers. It caches them for about a
minute (to prevent excessive writes to RRD files), identifies the link that
each record refers to (by means of the SNMP in/out interface index), maps it
to a corresponding "known link" and RRD data source, and then runs RRDtool. To
avoid losing new records while the RRD files are updated, the update task is
run in a separate process.


For each AS, a separate RRD file is created as needed. It contains two data
sources for each link - one for inbound and one for outbound traffic.
In generated per-AS traffic graphs, inbound traffic is shown as positive,
while outbound traffic is shown as negative values.


Another Perl script, rrd-extractstats.pl, is meant to run about once per hour.
It sums up per-AS and link traffic during the last 24 hours, sorts the ASes
by total traffic (descending) and writes the results to a text file. This
is then used to display the "top N AS" and other stats by the provided PHP
scripts."

Actions

This Discussion