Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Community Member

Netflow v9 Record Format Random Sampled Netflow - Are input and output octets already multiplied by sampling rate

With v5 Netflow the in/out octets need to be multiplied by the sampling rate to get an accurate estimate of the flow.


With v9 netflow are the in/out octets for random sampled netflow already scaled for the flow rate?


It is not clear from the v9 record format documentation if the sampling rate is informative, or if the output needs to be multiplied-up by that amount.


Everyone's tags (1)
Community Member

My reading of the Random

My reading of the Random Sampled NetFlow documentation from Cisco does make it seem that only data about the sampled packets is included, and doesn't mention that the sampling is corrected for by multiplying by the sampling rate to estimate total volume for flows.

I would like to see this answered explicitly. I've heard from another engineer who ran a large upload as an experiment and checked the result in a flows application that the result was a severley under-reported byte count.

Perhaps the reason it isn't spelled out in the docs is that it would imply suitability for accounting purposes? If that is the case, a disclaimer in the text should clarify things.

CreatePlease to create content