0

Current flow probes (using eg. IPFIX, netFlow v5/9, sFlow) are able to monitor flows defined at least by the tuple < source IP, source Port, IP protocol, destination IP, destination Port, source interface, destination interface >. But it seems to me that this flow definition might consume probe CPU (even if we use traffic sampling) and probe<->collector bandwidth

So questions are :

  • what kind of configuration do ISP and data center use ? do they use traffic aggregates (source-destination IP/net) as flow definition ? if so what is the subnet size ?
  • I heard that the common/minimum reporting period (interval for sending flow records towards the collector) is 5 minutes. Is it real ? is it less ?
  • "what kind of configuration do ISP and data center use ?" Whatever works for the particular ISP or datacenter to capture what is necessary for the particular management. Different companies have different needs. That question is actually off-topic because questions about networks you do not directly control are explicitly off-topic here. – Ron Maupin May 29 '17 at 13:41
1

what kind of configuration do ISP and data center use ?

It depends. Sometimes you just count bytes on interface and use netflow/sflow for (some) detailed analysis.

do they use traffic aggregates (source-destination IP/net) as flow definition ?

IMO the best option is to aggregate by the client port numbers. Every web page opening generates a dozen of flows with the same src/dst IPs, same dst port (say, 80) but a bunch of client IPs. Wiping out those client ports gives ~10 times less flows (from my experience) without loosing much.

if so what is the subnet size ?

It depends what your are using your flows for. Sometimes you want to know each IP traffic profile, sometimes you might aggregate using AS prefix lists, because all you need to know is a source/destination AS number...

I heard that the common/minimum reporting period (interval for sending flow records towards the collector) is 5 minutes. Is it real ? is it less ?

It depends. The question is too broad...

Not the answer you're looking for? Browse other questions tagged or ask your own question.