Current flow probes (using eg. IPFIX, netFlow v5/9, sFlow) are able to monitor flows defined at least by the tuple < source IP, source Port, IP protocol, destination IP, destination Port, source interface, destination interface >. But it seems to me that this flow definition might consume probe CPU (even if we use traffic sampling) and probe<->collector bandwidth
So questions are :
- what kind of configuration do ISP and data center use ? do they use traffic aggregates (source-destination IP/net) as flow definition ? if so what is the subnet size ?
- I heard that the common/minimum reporting period (interval for sending flow records towards the collector) is 5 minutes. Is it real ? is it less ?