Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

V8 Aggregation Cache

What is a

V8 Aggregation Cache?  I am reading my Operator's Manual for our NM-NAM, and it goes into some discussion under the "Monitoring Data" section about NDE Flow Masks and V8 Aggregation Caches.  I am not sure what the V8 Aggregation Cache is.

Our equipment is 3750 switches and 3800 series routers.  Do I need to configure or can i configure V8 Aggregation Caches on them?  What would be the benefit of such?

Thanks

Kevin

1 ACCEPTED SOLUTION

Accepted Solutions
Blue

Re: V8 Aggregation Cache

Looks like the NAM only supports 4 out of the 5 possible NetFlow v8 aggregation types:

http://www.cisco.com/en/US/docs/ios/solutions_docs/netflow/nfwhite.html#wp1061627

• Aggregated v5 flows.
• Much less data to post process, but
loses fine granularity of v5 – no IP
addresses.

http://nsrc.org/workshops/2009/apricot/netmanage/presos/netflow-slides.pdf

In my limited world, I haven't heard of anyone using v8.

3 REPLIES
Blue

Re: V8 Aggregation Cache

Looks like the NAM only supports 4 out of the 5 possible NetFlow v8 aggregation types:

http://www.cisco.com/en/US/docs/ios/solutions_docs/netflow/nfwhite.html#wp1061627

• Aggregated v5 flows.
• Much less data to post process, but
loses fine granularity of v5 – no IP
addresses.

http://nsrc.org/workshops/2009/apricot/netmanage/presos/netflow-slides.pdf

In my limited world, I haven't heard of anyone using v8.

New Member

Re: V8 Aggregation Cache

Bear

Your answer did help out though.  I did not know that "V8" stood for version 8 of Netflow. 

I had not heard of that before until examining configuration options on the NAM.

Looks like one would loose alot of important data.  I wonder what a practical example would be of why someone would ever implement it...

Anyhow Thanks!

Kevin

Blue

Re: V8 Aggregation Cache

Here's a tool that works exclusively with NetFlow v8 (and sFlow) data:

https://neon1.net/as-stats/

Its Readme kinda sums up what v8 records can be useful for:

"How it works
------------

A Perl script (netflow-asstatd.pl) collects NetFlow v8 AS aggregation records
or sFlow v5 samples from one or more routers. It caches them for about a
minute (to prevent excessive writes to RRD files), identifies the link that
each record refers to (by means of the SNMP in/out interface index), maps it
to a corresponding "known link" and RRD data source, and then runs RRDtool. To
avoid losing new records while the RRD files are updated, the update task is
run in a separate process.

For each AS, a separate RRD file is created as needed. It contains two data
sources for each link - one for inbound and one for outbound traffic.
In generated per-AS traffic graphs, inbound traffic is shown as positive,
while outbound traffic is shown as negative values.

Another Perl script, rrd-extractstats.pl, is meant to run about once per hour.
It sums up per-AS and link traffic during the last 24 hours, sorts the ASes
by total traffic (descending) and writes the results to a text file. This
is then used to display the "top N AS" and other stats by the provided PHP
scripts."

274
Views
5
Helpful
3
Replies