What is a common setting for NetFlow Active Flow Timeout?

Question

What is a common/best practice value for 'active flow time-out' for flow generation from packets.

With 'active flow time-out' I refer to the time limit when the current flow (src ip,dest ip, src port, dest port, proto) is considered ended if no new packet arrives within this time-limit.

It looks like this value ranges from 15 secs to 45 minutes, however the number of flows and characteristics depends on this timeout value.

Tx.

Answer 1

It is wholly dependent on the software that is collecting the flow. You would need to look up what the software vendor recommends and configure your devices accordingly. If it is higher you will get flows reporting the full flow duration instead of the say 60 second interval that is expected by certain platforms. This leads to incorrect flow accounting and general misinformation. Take the reverse for shorter flow expiration timers. If you can't find any information for your export product I would recommend 60 seconds, it is the most common in my experience.

Answer 2

So, lets look at the question a little more. Cisco and Juniper both have the active flow timeout at 1800s (30 minutes). That means if one flow lasts 15 minutes, you get one flow record for all that data, bytes and packets summed. If you set the flow active timeout to 60s, you'd get 15 flow records, with the same total sums, but split across 15 records with different timestamps.

In one big record:

1. It just takes 1 flow record - so only one datapoint to store.
2. It's unknown exactly how the data transfer speed changes within that flow record - was it fast at the beginning and then slow, or what? The netflow record doesn't contain that information, so it may either have a "flat" belief that the data flow was constant over the whole time period that was sent in the flow record, or it may all just put it in at the last timestamp.

If you set the timer to 60s, then:

1. You get 15 flow records - so 15x the data to store in your platform
2. You have much more of an idea of the transfer rate fluctuations - in other words instead of saying you left DC at noon and arrived at Boston at 8PM, you'd get timestamps along the way - Philadelphia at 2, New York at 5, etc.

Answer 3

I'm not sure if we can say that there is a best practice for this case. It's not a mandatory parameter to have your Netflow software working fine. I'm saying that it is not mandatory cause I don't have it configured on my Cisco devices and my Netflow software works fine. Anyway, take a look on this link where they explain a little bit better this question: https://www.manageengine.com/products/netflow/help/index.html It is from a specific manufacturer but maybe it works like a standard explanation.