Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

How much traffic generates NetFlow?

There is a customer with a SL2000 Licence. At the moment there are only a few ports monitored.

The plan is to monitor about 300 routers from external Sites, which are connected via MPLS.

The Toloplogie is something like this:

There are two Routers through wihich all traffic is coming in.

The question is: How amny traffic will be generated by 300 monitored Nodes with 2 Interfaces each, which are used by 10 clients in average.

I need just a guess.

Thx

Leo

Find more posts tagged with

Accepted answers

chris.lapoint

You could enable NetFlow on one of the routers, view the amount of NetFlow packets exported (flow-export show counters), then extrapolate from there. I don't see how else you would guess. The way NetFlow worsk, all packets with the same source/destination IP address, source/destination ports, protocol interface and class of service are grouped into a flow and then packets and bytes are summed. So, the amount of flows generated will depend on the targets of the traffic generated by the clients in each site. If there's a wide range of IPs being contacted by clients in a particular site, you may see more flows being created by that router.

All comments

chris.lapoint

Just FYI, I remember hearing that 1-5% of switched traffic is used for flow export to collection server. You'll want to confirm though with other sources. Any existing customers want to chime in here?

quantus

That sounds about right to me. We have 68 locations with 3 to 8 devices at each using NetFlow and each location is between 8kbps and 70kbps of combined Orion traffic (Netflow + ICMP and SNMP), for a total of about 850kbps at the head-end of the WAN - about 2% of total traffic traversing the head-end.

We're currently on a T1-based frame relay WAN also, which IIRC generates more overhead than an MPLS cloud.

jswan

I have heard the 1-5% number multiple times from Cisco engineers too. It fits with my experience; we are at around 2% on most of our links.