Collection Architecture Scalability And Reliability; Export Criteria - Extreme Networks PoS Installation And User Manual

Configuring the PoS Module
components of a forwarded flow with the associated masks from the first filter. Statistics
are maintained if the results of the AND operations match the configured filter values
for all fields of the five flow components. If there is not a match on all fields of the five
components, then the operation is repeated for the second filter, and so on. If there is no
match for any of the filters, then statistics are not maintained for the flow.

Collection Architecture Scalability and Reliability

By supporting statistics distribution across groups of flow-collector devices, the
NetFlow distribution function enables a scalable collection architecture that is able to
accommodate high volumes of exported data. The function also includes a health-check
feature that significantly improves the reliability of the collection architecture. The
health-checker ensures that only responsive flow-collector devices are included in the
effective export distribution lists.
Up to 32 export distribution groups can be configured on a Black Diamond 6800 series
switch. Each of these groups can contain the addresses of up to eight flow-collector
devices. A particular export group can then be specified for each filter, which provides a
high-degree of flexibility.
A filter-based aggregation capability is also offered to further enhance scalability. Each
filter can be configured to be either a per-flow filter or an aggregation filter. When a flow
matches a filter that is configured as an aggregation, normal per-flow statistics are not
maintained for the flow. Instead, a single set of statistics is maintained for all the flows
that match the aggregation filter, which can substantially reduce the volume of exported
data.
Aggregated flow statistics are also exported in the NetFlow Version 1 format. The
nexthop field of the flow record (see Table 3-12) is set to xFFFF to indicate that the record
is associated with a filter-based aggregation. The srcaddr, dstaddr, srcport, dstport, and prot
fields of an aggregated flow record are set to the corresponding value components of
the associated filter specification.

Export Criteria

TCP flow records are exported when the associated connection is terminated. Flow
records are also exported on an age basis. All flow records, including aggregation
records, are examined at least once every 30 minutes. If the age of the flow is greater
than a configurable time, the record is exported. If the flow is still active, a new flow
record will be created when the next packet arrives.
The PoS module transmits a NetFlow Export Datagram when 25 flow records are ready
for export, or when at least one flow has been awaiting export for one second.
3-64 Packet Over SONET Module Installation and User Guide