Cisco WS-SUP32-GE-3B - Supervisor Engine 32 Software Configuration Manual page 758

Understanding NDE
the number of packets that need to be exported to an external collector. Reducing the number of packets
that need to be exported to an external collector by reducing the number of packets that are analyzed is
useful when the volume of exported traffic created by analyzing every packet will overwhelm the
collector, or result in an over-subscription of an outbound interface.
NetFlow traffic sampling and export for software-based NetFlow accounting behaves in the following
manner:
•
•
•
On Cisco 6500 series switches, NetFlow traffic sampling is supported only on the MSFC for software
switched packets. For more information on configuring NetFlow traffic sampling, see the Cisco IOS
NetFlow Configuration Guide.
NetFlow Flow Sampling
NetFlow flow sampling does not limit the number of packets that are analyzed by NetFlow. NetFlow flow
sampling is used to select a subset of the flows processed by the router for export. Therefore, NetFlow
flow sampling is not a solution to reduce oversubscribed CPUs or oversubscribed hardware NetFlow
table usage. NetFlow flow sampling can help reduce CPU usage by reducing the amount of data that is
exported. Using NetFlow flow sampling to reduce the number of packets that need to be exported to an
external collector by reporting statistics on only a subset of the flows is useful when the volume of
exported traffic created by reporting statistics for all of the flows will overwhelm the collector, or result
in an over-subscription of an outbound interface.
NetFlow flow sampling is available on Cisco Catalyst 6500 series switches for hardware-based NetFlow
accounting on the PFCs and DFCs installed in the router.
NetFlow flow sampling and export for hardware-based NetFlow accounting behaves in the following
manner:
•
•
•
•
When NetFlow flow sampling is enabled, aging schemes such as fast, normal, long aging are disabled.
Note
You can configure NetFlow flow sampling to use time-based sampling or packet-based sampling. With
either the full-interface or destination-source-interface flow masks, you can enable or disable NetFlow
Flow Sampling on each Layer 3 interface.
Packet-based NetFlow Flow Sampling
Packet-based NetFlow flow sampling uses a sampling-rate in packets and an interval in milliseconds to
select a subset (sample) of flows from the total number of flows processed by the router. The values for
the sampling-rate are: 64, 128, 256, 512, 1024, 2048, 4096, 8192. The interval is a user-configurable
value in the range 8000-16000 milliseconds. The default for the interval is 16000 milliseconds. The
interval value replaces the aging schemes such as fast, normal, long aging for expiring flows from the
cache. The command syntax for configuring packet-based NetFlow flow sampling is:
mls sampling packet-based rate [interval].
Catalyst Supervisor Engine 32 PISA Cisco IOS Software Configuration Guide, Release 12.2ZY
46-8
The flows are populated with statistics from a subset of the traffic that is seen by the router.
The flows are expired.
The statistics are exported.
Packets arrive at the switch and flows are created/updated to reflect the traffic seen.
The flows are expired.
The flows are sampled to select a subset of flows for exporting.
The statistics for the subset of flows that have been selected by the NetFlow flow sampler are
exported.
Chapter 46 Configuring NDE
OL-11439-03