CoreyMac

Thanks very much Andy.

Having the refresh time on every charting page in the corner seems important for all graphs except maybe the "Print View"....

After changing the thread count to 20, the number of threads in the NetFlow Service went from a solid 30 (according to PerfMon) to fluctuating between 42-45. Still though the Raw Packet Queue length grows... It is up to about 1000 in a few minutes... (~5) Setting it to 30 raised the process thread count to 52 and still the…

From the router IP flow cache you can see the partners in the traffic. These are not the ones listed in the NetFlow conversations for this 10.20.0.30 IP address. Also, the charts for the NetFlow traffic do not jive with the charts for the interface traffic, even though we know where it is coming from the NetFlow traffic is…

Here is a document that provides more detail on NetFlow, platforms and such. http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6555/ps6601/prod_white_paper0900aecd80406232.pdf Here is one that coveres the platforms and commands required with examples for most platforms...…

One more thought... as you enable the flow collection put a packet analyzer on the traffic headed for the NetFlow collector (the default UDP port is 2055). From that you can see exactly what traffic is using the WAN link for NetFlow. If I capture during a fairly busy time (right now), I see about 8 packets each second...…

Mine is behaving similarly and our workaround was to use a scheduled task to restart the service every so often (daily in this case). The counter you mentioned has ,after about 19 hours, climbed to ~206,000+ and is growing about 5-10K per hour. I am only collecting flows from three routers though so our traffic is not what…

Scorpio, If it is a reason for the crash you are seeking then it is most likely due to a problem in NetFlow v3. You can look around in the various forum messages and find two things. NetFlow v3 works for some, but not others (no idea of the ratio) due to what appears to be a problem with the way that data in managed…

So what are you looking for? 

We dont just see that, but much higher overall SQL load for the Orion SQL server after we installed the NetFlow period... So much so we are moving it to another system. There are some pieces of NetFlow that seem to have lowered the impact some from the previous release, but overall it added a large amount of SQL work for…

This is just my experience, so caveat emptor... If you have the IP route flow cache enabled on the router interfaces, you can get a rough idea of the data rate for NetFlow this way... To see and estimate of the current number of flows. RTR01#sh ip cache flow IP packet size distribution (7098M total packets): 1-32 64 96 128…