Introduction To Netstream Aggregation; Implementation Of Netstream - 3Com MSR 50 Series Configuration Manual

2040 C 110: N S
HAPTER ET TREAM
n
Introduction to
NetStream Aggregation
n
Implementation of
NetStream
C
ONFIGURATION
XLog network log audit system (XLog) provides solutions for administrators to
audit users' logs through networking with network devices such as routers and
switches. XLog supports logs such as NAT, FLOW, DIG and NetStreamv5.
NetStream provides the aggregation function, where aged stream statistics are
classified and aggregated according to certain rule. The aggregation information is
then transmitted.
At present, five aggregation approaches as described in the following table are
available.
Table 58 Five aggregation modes of NetStream
Mode
Autonomous system (AS)
aggregation
Protocol-port aggregation
Source-prefix aggregation
Destination-prefix aggregation
Source and destination prefix
aggregation
According to the classification rule of the specified aggregation mode, the system
merges multiple streams into one, which corresponds to one aggregation record.
The five modes work independently but you may configure them at the same
time.
With NetStream enabled, the device first stores statistics collected for each stream
in a NetStream cache, and when they get aged, sends them in UDP packets to
NSC and clear the statistics from the NetStream cache.
NetStream uses two versions of UDP packets: version 5 and version 8. Generally,
aged stream statistics are delivered in version 5 UDP packets.
When you configure the attributes of version 5 UDP packets:
If no NetStream aggregation is configured, the device sends the aged statistics
■
in version 5 UDP packets to the NSC.
When NetStream aggregation is configured, stream statistics are classified and
■
aggregated according to certain rule. The aggregate information is transmitted
in version 8 UDP packets to the NSC.
MPLS stream statistics are sent in version 9 UDP packets. When you configure the
attributes of version 9 NetStream statistics packets, the device sends the statistics
in version 9 packets to NSC.
Classification rule
Source AS number, destination AS number, inbound
interface index, outbound interface index
Protocol number, source port, destination port
Source AS number, source address mask length, source
prefix, inbound interface index
Destination AS number, destination address mask length,
destination prefix, outbound interface index
Source AS number, destination AS number, source address
mask length, destination address mask length, source
prefix, destination prefix, inbound interface index,
outbound interface index