Mailing List Archive: NANOG: users

Help needed - Cisco Netflow

Index | Next | Previous | View Threaded

kin-wei.lee at hp

Oct 10, 2008, 9:16 AM

Post #1 of 7 (2724 views)
Permalink

Help needed - Cisco Netflow

Hi all, I have a customer who has a MPLS network for E/// Media Gateway (MGW) NB-AMR VoIP traffic. The packet size for the NB-AMR traffic is fixed size 110 bytes. During the high load period, it can reaches 450Kpps on a STM-1 link. The router platform is Cisco 12000 series, can the router generate 100% netflow data with such traffic load? Also can someone suggest a carrier class netflow collector for mobile service provider environment.

Thanks in advance.

Regards,
Steven Lee

cmills at accessdc

Oct 10, 2008, 9:46 AM

Post #2 of 7 (2568 views)
Permalink

RE: Help needed - Cisco Netflow [In reply to]

Lee,
The question would be do you want a self contained appliance or a
piece of software? I have used Advent Network's Net Flow Analyzer.
There are others out there but I've had some decent amount of luck with
these guys and they have an "Enterprise" license that will many, many
(thousands?) interfaces.
For the traffic load and the number of flows/second I'm guessing
you'll need a really high end Linux box with lots and lots of disk
space.
There are open source netflow collectors too you could deal with if
cost is an issue or you have the talent on staff to maintain it.

Chuck

-----Original Message-----
From: Lee, Steven (NSG Malaysia) [mailto:kin-wei.lee [at] hp]
Sent: Friday, October 10, 2008 12:17 PM
To: nanog [at] nanog
Subject: Help needed - Cisco Netflow

Hi all, I have a customer who has a MPLS network for E/// Media Gateway
(MGW) NB-AMR VoIP traffic. The packet size for the NB-AMR traffic is
fixed size 110 bytes. During the high load period, it can reaches
450Kpps on a STM-1 link. The router platform is Cisco 12000 series, can
the router generate 100% netflow data with such traffic load? Also can
someone suggest a carrier class netflow collector for mobile service
provider environment.

Thanks in advance.

Regards,
Steven Lee

This e-mail message and any files transmitted with it contain confidential information intended only for the person(s) to whom this email message is addressed. If you have received this e-mail message in error, please notify the sender immediately by telephone or e-mail and destroy the original message without making a copy. Thank you.
Neither this information block, the typed name of the sender, nor anything else in this message is intended to constitute an electronic signature unless a specific statement to the contrary is included in this message.

Keith.Kocher at JTV

Oct 10, 2008, 10:17 AM

Post #3 of 7 (2584 views)
Permalink

RE: Help needed - Cisco Netflow [In reply to]

Open source netlow collector NTOP: http://www.ntop.org

-----Original Message-----
From: Mills, Charles [mailto:cmills [at] accessdc]
Sent: Friday, October 10, 2008 12:46 PM
To: Lee, Steven (NSG Malaysia); nanog [at] nanog
Subject: RE: Help needed - Cisco Netflow

Lee,
The question would be do you want a self contained appliance or a
piece of software? I have used Advent Network's Net Flow Analyzer.
There are others out there but I've had some decent amount of luck with
these guys and they have an "Enterprise" license that will many, many
(thousands?) interfaces.
For the traffic load and the number of flows/second I'm guessing
you'll need a really high end Linux box with lots and lots of disk
space.
There are open source netflow collectors too you could deal with if
cost is an issue or you have the talent on staff to maintain it.

Chuck

-----Original Message-----
From: Lee, Steven (NSG Malaysia) [mailto:kin-wei.lee [at] hp]
Sent: Friday, October 10, 2008 12:17 PM
To: nanog [at] nanog
Subject: Help needed - Cisco Netflow

Hi all, I have a customer who has a MPLS network for E/// Media Gateway
(MGW) NB-AMR VoIP traffic. The packet size for the NB-AMR traffic is
fixed size 110 bytes. During the high load period, it can reaches
450Kpps on a STM-1 link. The router platform is Cisco 12000 series, can
the router generate 100% netflow data with such traffic load? Also can
someone suggest a carrier class netflow collector for mobile service
provider environment.

Thanks in advance.

Regards,
Steven Lee

This e-mail message and any files transmitted with it contain confidential information intended only for the person(s) to whom this email message is addressed. If you have received this e-mail message in error, please notify the sender immediately by telephone or e-mail and destroy the original message without making a copy. Thank you.
Neither this information block, the typed name of the sender, nor anything else in this message is intended to constitute an electronic signature unless a specific statement to the contrary is included in this message.

kin-wei.lee at hp

Oct 10, 2008, 10:20 AM

Post #4 of 7 (2572 views)
Permalink

RE: Help needed - Cisco Netflow [In reply to]

Hi all, the LC on 12000 series is 12000-SIP-601 (engine 5) with multiple STM-1 SPA card. As far as I know the engine 5 card cannot do 450Kpps on netflow. Since the STM-1 is mainly for NB-AMR traffic (95%), do you recommend the sampled netflow instead? Does anyone aware of the sampled netflow accuracy?

-----Original Message-----
From: Julio Arruda [mailto:jarruda-cnsp [at] jarruda]
Sent: Saturday, October 11, 2008 12:43 AM
To: Lee, Steven (NSG Malaysia)
Subject: Re: Help needed - Cisco Netflow

Lee, Steven (NSG Malaysia) wrote:
> Hi all, I have a customer who has a MPLS network for E/// Media Gateway (MGW) NB-AMR VoIP traffic. The packet size for the NB-AMR traffic is fixed size 110 bytes. During the high load period, it can reaches 450Kpps on a STM-1 link. The router platform is Cisco 12000 series, can the router generate 100% netflow data with such traffic load? Also can someone suggest a carrier class netflow collector for mobile service provider environment.
Just a quick note..
You may want to post the Line Cards they have...Distinct LC have distinct Netflow capabilities (and impact).

bedard.phil at gmail

Oct 10, 2008, 11:17 AM

Post #5 of 7 (2559 views)
Permalink

Re: Help needed - Cisco Netflow [In reply to]

It depends on how many active flows you have at any one time. Also, I
don't think the SIP-601 supports full netflow V5 in hardware, only V8,
which is aggregated netflow, which may not be what you want. It does
do V5/V9 sampled netflow in hardware. The sampled netflow on that
platform is better than on say the 6500/7600, so I would just go with
that.

Phil

On Oct 10, 2008, at 1:20 PM, Lee, Steven (NSG Malaysia) wrote:

> Hi all, the LC on 12000 series is 12000-SIP-601 (engine 5) with
> multiple STM-1 SPA card. As far as I know the engine 5 card cannot
> do 450Kpps on netflow. Since the STM-1 is mainly for NB-AMR traffic
> (95%), do you recommend the sampled netflow instead? Does anyone
> aware of the sampled netflow accuracy?
>
> -----Original Message-----
> From: Julio Arruda [mailto:jarruda-cnsp [at] jarruda]
> Sent: Saturday, October 11, 2008 12:43 AM
> To: Lee, Steven (NSG Malaysia)
> Subject: Re: Help needed - Cisco Netflow
>
> Lee, Steven (NSG Malaysia) wrote:
>> Hi all, I have a customer who has a MPLS network for E/// Media
>> Gateway (MGW) NB-AMR VoIP traffic. The packet size for the NB-AMR
>> traffic is fixed size 110 bytes. During the high load period, it
>> can reaches 450Kpps on a STM-1 link. The router platform is Cisco
>> 12000 series, can the router generate 100% netflow data with such
>> traffic load? Also can someone suggest a carrier class netflow
>> collector for mobile service provider environment.
> Just a quick note..
> You may want to post the Line Cards they have...Distinct LC have
> distinct Netflow capabilities (and impact).
>

mohacsi at niif

Oct 12, 2008, 10:48 AM

Post #6 of 7 (2558 views)
Permalink

Re: Help needed - Cisco Netflow [In reply to]

On Fri, 10 Oct 2008, Lee, Steven (NSG Malaysia) wrote:

> Hi all, I have a customer who has a MPLS network for E/// Media Gateway
> (MGW) NB-AMR VoIP traffic. The packet size for the NB-AMR traffic is
> fixed size 110 bytes. During the high load period, it can reaches
> 450Kpps on a STM-1 link. The router platform is Cisco 12000 series, can
> the router generate 100% netflow data with such traffic load? Also can
> someone suggest a carrier class netflow collector for mobile service
> provider environment.

Forget full netflow with 12000. It is not supported....

Janos Mohacsi
Network Engineer, Research Associate, Head of Network Planning and Projects
NIIF/HUNGARNET, HUNGARY
Key 70EF9882: DEC2 C685 1ED4 C95A 145F 4300 6F64 7B00 70EF 9882

>
> Thanks in advance.
>
> Regards,
> Steven Lee
>
>

jloiacon at csc

Oct 13, 2008, 8:10 AM

Post #7 of 7 (2583 views)
Permalink

RE: Help needed - Cisco Netflow [In reply to]

"Lee, Steven (NSG Malaysia)" <kin-wei.lee [at] hp> wrote on 10/10/2008
01:20:30 PM:

> Does anyone aware of the sampled netflow accuracy?

If you mean how well you can extrapolate "real" numbers from "samples" by
multiplying by the inverse sample rate, my (initial and somewhat limited)
testing showed a surprising correlation. A pretty good first
approximation.

Joe

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads