When you attach a monitor using deterministic sampler (for example, s1), every attachment with same sampler s1 uses one new free sampler from the switch (hardware) out of 4 available samplers. Note the following when configuring a sampler to an interface: The window size to select packets from ranges from 32 to 1022. Select m packets out of an n packet window. You can configure either a random or deterministic sampler to an interface. How can i achieve that on a 2960X?Ĭisco Documentation for NetFlow Lite on 2960X ( Link here) says following: Defines the random sample mode. Very similar question has been asked here:Īnswer says to use NetFlow without sampling. Netflow works fine on this switch, the cache is full of entries and i receive data on my NetFlow collector every 60 second.
Strange thing is, if I check the sampler on my switch, it doesn't show any samples: swDAI01# show sampler netflowįlow monitor netflow (ip,Gi1/0/1,Input) 0 out of 0įlow monitor netflow (ip,Gi1/0/3,Input) 0 out of 0 Or does the 1 out-of 32 only come into play if the CPU of the switch is too high? How can i verify that all the packets flowing thru the switch are being inspected/recorded? Am i right? If so, the data recorded by NetFlow is very unreliable as only a small portion of traffic is being collected. If we use random sampling, we can monitor 256 interfaces max (either 256 SVI or 48 Gi) but the 1 out-of 32 suggests, that only every 32nd packet is being inspected/recorded.
All i understand so far: We can configure deterministic sampling, that uses a hardware sampler per interface, limiting the maximum number of monitoring to 4 Interfaces because 2960X switches do have 4 hardware samplers.
I am getting into NetFlow a little bit deeper but cannot get my head around sampling.
0 kommentar(er)
