Cisco Netflow CPU Utilisation Question

Posted on 2013-09-15
Medium Priority
Last Modified: 2013-09-27
Hello Experts,

Can someone please tell me if adding the following Netflow Record and corresponding Monitor will overwhelm the cpu on our router?

flow record FlowRecord1
match ipv4 protocol
match ipv4 tos
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match flow direction
match interface input
match interface output
collect flow direction
collect transport tcp flags
collect transport tcp source-port
collect transport tcp destination-port
collect routing source as
collect routing destination as
collect routing source as peer
collect routing destination as peer
collect routing next-hop address ipv4
collect routing destination as
collect ipv4 source prefix
collect ipv4 id
collect ipv4 protocol
collect ipv4 tos
collect ipv4 routing source as
collect ipv4 source mask
collect ipv4 destination prefix
collect ipv4 destination mask
collect interface input
collect interface output
collect counter bytes
collect counter packets
collect application name
collect timestamp sys-uptime first
collect timestamp sys-uptime last
collect timestamp absolute first
collect timestamp absolute last

flow monitor FlowMonitor1
 cache timeout active 86520
 cache entries 32768
 record FlowRecord1


Question by:cpatte7372

Expert Comment

ID: 39494628
Hi Carlton.

This all depends on a few things like, network usage / speed of link to, the router, and processor engine installed.
LVL 17

Accepted Solution

surbabu140977 earned 2000 total points
ID: 39496219
Unless you paste the device hardware specs, where you plan to do this it will not be possible to forecast. Also to be taken into account is: the present cpu/memory utilization. Then only some calculated guess can be made, although it might vary hugely with practical implementation.

Best way would be to go phase by phase while keeping a tab on the resource utilization. I do not think any scientific benchmark exist for this. You just need to keep checking the CPU utilization once you enable step by step.

If your present CPU utilization is <40%, roughly the guess would be to go for few at a time and gradually keep adding the match-collect criterion till it reaches 70%. You should stop at 80% cpu max.


Author Closing Comment

ID: 39527556
Cheers mate.

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

In this tutorial I will show you with short command examples how to obtain a packet footprint of all traffic flowing thru your Juniper device running ScreenOS. I do not know the exact firmware requirement, but I think the fprofile command is availab…
Shadow IT is coming out of the shadows as more businesses are choosing cloud-based applications. It is now a multi-cloud world for most organizations. Simultaneously, most businesses have yet to consolidate with one cloud provider or define an offic…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

624 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question