tips:ingress-egress-netflow
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
tips:ingress-egress-netflow [2020/11/27 13:55] – veera | tips:ingress-egress-netflow [2020/11/27 15:12] – [Performance note about egress netflow] veera | ||
---|---|---|---|
Line 6: | Line 6: | ||
Netflow has historically been an ingress only technology. Later versions of Netflow added the option to enable netflow at the egress interface as well. One way wonder how an analyst can get both the interfaces if Netflow is enabled in one direction only. The answer lies in the structure of the Netflow record. | Netflow has historically been an ingress only technology. Later versions of Netflow added the option to enable netflow at the egress interface as well. One way wonder how an analyst can get both the interfaces if Netflow is enabled in one direction only. The answer lies in the structure of the Netflow record. | ||
+ | |||
+ | < | ||
===== Enabling both ingress and egress can result in inconsistent data ===== | ===== Enabling both ingress and egress can result in inconsistent data ===== | ||
Line 25: | Line 27: | ||
- If used with a sampler can cause inconsistent data | - If used with a sampler can cause inconsistent data | ||
- | {{: | + | [{{: |
Line 41: | Line 44: | ||
The following diagram shows a valid use case. | The following diagram shows a valid use case. | ||
- | {{: | + | [{{: |
In this example the red and blue flows are measured for Netflow at the upstream interfaces only. Hence there will be no duplicate or inconsistent data. | In this example the red and blue flows are measured for Netflow at the upstream interfaces only. Hence there will be no duplicate or inconsistent data. | ||
Line 51: | Line 54: | ||
//Egress NetFlow accounting might adversely affect network performance because of the additional accounting-related computation that occurs in the traffic-forwarding path of the router.// | //Egress NetFlow accounting might adversely affect network performance because of the additional accounting-related computation that occurs in the traffic-forwarding path of the router.// | ||
+ | |||
+ | |||
+ | ===== Configuration options in Trisul ===== | ||
+ | |||
+ | Trisul' | ||
+ | |||
+ | If you have a network with incorrectly configured ingress and egress netflow you can ignore the //egress// netflow | ||
tips/ingress-egress-netflow.txt · Last modified: 2020/11/27 16:05 by veera