© 2011 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 7 of 14
The data-link MAC destination/source address provides the unique identifier of the user device receiving/sending
traffic to the switch, along with information about the device vendor available from its organizationally unique
identifier (OUI).
The source and destination VLAN fields provide information on what switch VLAN is used by the traffic. Note that
source VLAN is available for flow monitors defined for the input (downstream) direction, while destination VLAN is
for the output (upstream) direction. Source and destination VLAN fields cannot be used together when monitoring a
particular direction.
The CoS field for output traffic provides the Layer 2 quality-of-service (QoS) priority value assigned to a flow by the
switch. In the opposite direction, the reported value is the one assigned by the other switches in the network facing
the service module ports.
The input/output interface value reports the Simple Network Management Protocol (SNMP) interface index value
for the physical interface the traffic is entering/exiting the switch. For example in the case of a downstream flow, the
input interface value refers to a port on the service module, while the output interface value refers to a downlink
port. The latter can be used to track the location of the user device, when integrated with information coming from a
wired location database and with cable length measured by Cisco time domain reflectometry (TDR).
Performance
Each service module is capable of handling 32,000 flows at the same time. The number of monitors supported
depends on their record definition. For records including Layer 2 and Layer 3 fields, it is possible to have up to 128
simultaneous monitors.
In is important noting that these numbers scale with the number of service modules in the stack: for example, 4
service modules in the stack can store 128,000 flows and have 512 simultaneous monitors. This is different from
other resources in the stack, for example, ternary content-addressable memory (TCAM) space and CPU memory,
which do not increase when adding new stack members.
As explained in the "Architecture Overview" section, there is no switch CPU degradation due to exporting flows, as
this task is totally performed by the service module itself. There is no hard limit to the number of exporters defined:
the service module was successfully tested with 10 exporters per monitor.
Exporting flows minimally affects data traffic bandwidth either, due to the design of Cisco Flexible NetFlow. It is
worth mentioning that Layer 3 priority can be configured for exported packets to avoid being dropped in case of
congestion.
Flexible NetFlow in Access
Enabling NetFlow at the access switch maximizes end-user traffic visibility. In fact, it is possible to correlate the
device location information, provided by the interface port number connecting to the endpoint, with its unique
address at data link and network layer. As identity functions such as user authentication are taking place in the
access layer, adding identity awareness is the natural evolution for future Flexible NetFlow implementations.
Cisco Flexible NetFlow envisions a distributed architecture, where NetFlow monitoring is performed real time in
various points of the network and information is sent to centralized collectors for further analysis and offline data
mining. As the number of access switches is typically greater than distribution and core, they can scale better and
make sure there are no performance effects of oversubscription at aggregation and core.
(2 pages)
Manymanuals.com
Manymanuals.de
Manymanuals.fr
Manymanuals.it
Manymanuals.pl
Manymanuals.cz
Manymanuals.es
Manymanuals-pt.com
Comments to this Manuals