2

I'm working on a project where I could need Nexus 5600. These switches support sampled netflow and not netflow. I would like to use netflow to do stats and to analyze trafic at some specific times.

Is sampled netflow good for watching trafic at a time where I underwent a problem? I mean, as it exports just a rate of packets, I won't have a good view of the amount of trafic that passed really?

I'm hesistating between sampled netflow and SPAN with a netflow 3000 appliance. It could be a good solution too but the switch can just handle 2 sessions?

What do you recommend?

Improve this question

2 Answers 2

Reset to default
3

For traffic analysis sampled netflow is often used, because 1:1 sampling (or non-sampled) netflow can be quite a burden on both the router sending the flow data and on the flow receiver. Most setups I've seen use a sampling rate varying from 1:100 upto 1:4000 (depending on the size of the network and the amount of traffic pushed), and they're perfectly able to do traffic anomaly analysis (DDoS detection) or even customer usage billing with that.

Improve this answer
2
  • Thanks, so if I want an interface bw utilization, sampled is good too? Because we can collect the number of packets, that's right?
    – Jey10
    Commented Jan 28, 2017 at 9:26
  • Yes, that works fine. You just multiply the measured data rate with the sampling rate on the netflow collector so it becomes an approximation of the actual traffic rate.
    – Teun Vink
    Commented Jan 28, 2017 at 9:31
0

Sampling is good for determining top applications. If you need to perform investigations, you will probably desire 100% flow collection. It can be frustrating when you go to look at traffic from a specific host and it wasn't sampled enough or at all. If you are just looking to get over all traffic utilization, use SNMP if it is an option. Multiplying the sampled flows in order to determine the actual utilization will give some pretty crazy results which can often be misleading.

I read that the 5000 can only sample NetFlow which means you might not have many options. If you haven't purchased the switch yet, you might want to consider a switch that allows you to avoid sampling.

Improve this answer
3
  • Not many of those out there any more (full flow boxes) - the mechanics of building a box where 10G is considered a low-speed interface is beyond challenging. Flow caches tend to blow out in seconds and you quickly approach a degenerate point where flow records are generated almost at the rate of packets coming through the box. There's a lot of push toward either off-box generation or the use of different means of data collection that don't require much in the way of control plane resources.
    – rnxrx
    Commented Jan 28, 2017 at 18:37
  • @rnxrx you mean finally that the sampling is a good solution for the 10G traffic ? With nexus 5600 I will use only 10G (even 40G maybe) on the interfaces, so I was thinking sampled netflow can offer more interfaces monitored than a 1:1 flow?
    – Jey10
    Commented Jan 28, 2017 at 19:08
  • Sampling is a good solution for just about any interface speed as long as your data collection tool can interpolate the data correctly. Sampling is more than fine for getting a sense of just about any statistical information - top talkers, apps in use, general utilization, etc. The one case that isn't addressed is analytics that need to see information about every single packet (almost exclusively security tools) but for most traffic analysis it's fine. The 5600 does the sampling in hardware and is rated to run all the interfaces in the box.
    – rnxrx
    Commented Jan 28, 2017 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.