NetFlow traffic volume?

Question

NetFlow

I would like to know approximately what percentage NetFlow gives to the main stream and whether it makes sense to throw a separate physical cable from the switch to the second network card of the traffic collector (aka billing). Reading popular literature did not bring answers to these questions. Probably somewhere in the depths of the cisco docks there is an answer, but I have not found it yet. Enlighten please knowledgeable people.

Answer 1

Depends on sampling.

Answer 2

Rough estimate from experience: 0.5%.

Answer 3

Netflow traffic strongly depends on the nature of the main stream: if even a lot of gigabits fly there, but they fly in one stream from one src address / port pair to one dst address / port pair, then there will be very little, and if there (mother-mother) a dozen multi-megabit torrent-lovers-sidders... Throwing a
cable makes sense, not because of the amount of traffic, but because if the flow on the main link reaches the physics limit, then netflow will suddenly not fit there - but rather, nevertheless, it will interfere with the main flow.
But you see what you want to get. Sometimes sampling (sampling) is enough, especially since netflow is actually connected with "its own moments": for archival purposes it would be better to store full reports, but if the flows are large and the nature of the traffic is stormy (torrents are the same), then you will have to store a lot . On the other hand, is it necessary to store such good as a picture of the work of a torrent in too much detail? Billing can calculate, but you will still go to the archive aggregated records, for sure - and if so, maybe you can afford to enable sampling on the sensor?

Answer 4

Antonvn is relatively correct. Measured at one time on ~ 50 provider-clients, all have about 0.5-1.5% of traffic (measurement for 1 hour, during the day).

Answer 5

I have a 10Gbps external traffic in a 100Mbps netflow traffic.
Of course, depending on how many fields you will be exporting, flexible netflow can adjust these settings and reduce the load. Cisco no longer supports traditional netflow, that is, it is not possible to contact TAC with a problem.
Not long ago I solved the problem with the fact that the netflow traffic on the charts began to rest against the shelf, in cases of a separate link, such a problem is easier to diagnose.