Best practices for IP Flow monitoring [closed]

Question

Current flow probes (using eg. IPFIX, netFlow v5/9, sFlow) are able to monitor flows defined at least by the tuple < source IP, source Port, IP protocol, destination IP, destination Port, source interface, destination interface >. But it seems to me that this flow definition might consume probe CPU (even if we use traffic sampling) and probe<->collector bandwidth

So questions are :

• what kind of configuration do ISP and data center use ? do they use traffic aggregates (source-destination IP/net) as flow definition ? if so what is the subnet size ?
• I heard that the common/minimum reporting period (interval for sending flow records towards the collector) is 5 minutes. Is it real ? is it less ?

Answer 1

what kind of configuration do ISP and data center use ?

It depends. Sometimes you just count bytes on interface and use netflow/sflow for (some) detailed analysis.

do they use traffic aggregates (source-destination IP/net) as flow definition ?

IMO the best option is to aggregate by the client port numbers. Every web page opening generates a dozen of flows with the same src/dst IPs, same dst port (say, 80) but a bunch of client IPs. Wiping out those client ports gives ~10 times less flows (from my experience) without loosing much.

if so what is the subnet size ?

It depends what your are using your flows for. Sometimes you want to know each IP traffic profile, sometimes you might aggregate using AS prefix lists, because all you need to know is a source/destination AS number...

I heard that the common/minimum reporting period (interval for sending flow records towards the collector) is 5 minutes. Is it real ? is it less ?

It depends. The question is too broad...