Random sampled netflow configuration on cisco

veesri · ‎04-15-2010

Hi there

,

We implemented Random sampled netflow on one of our interfaces on cisco 6509. We issued the command in such a way that it captures packets one out of 1000. The moment this was implemented, the cpu utilisation was high and it reached upto 99% , which reduced later to 50%. But there were spikes in the utilization of the CPU and hence we had to remove the configuration.

Any idea what could have caused this?

Best regards,

VK

Ganesh Hariharan · ‎04-18-2010

Hi there

,

We implemented Random sampled netflow on one of our interfaces on cisco 6509. We issued the command in such a way that it captures packets one out of 1000. The moment this was implemented, the cpu utilisation was high and it reached upto 99% , which reduced later to 50%. But there were spikes in the utilization of the CPU and hence we had to remove the configuration.

Any idea what could have caused this?

Best regards,

VK

Hi VK,

CPU impact of enabling NetFlow services in various scenarios on several different Cisco hardware platforms.check out the below link for more information.

http://www.ciscosistemas.org/en/US/technologies/tk543/tk812/technologies_white_paper0900aecd802a0eb9.html

Hope to Help !!

Remember to rate the helpful post

Ganesh.H

jakewilson · ‎04-20-2010

I reviewed the URL Ganesh posted and saw "Distributed Cisco Express Forwarding was employed in this test, the CPU utilization numbers were collected on the line cards, not the main CPU." Did you enable CEF?

The Cisco 6500 is an interesting beast when it comes to NetFlow. We posted a blog on it the other day:

http://www.plixer.com/blog/netflow/catalyst-6500-and-missed-flows/

Can you post the commands you used to configure sampling?

Jake