On Sep 1, 2013, at 7:57 AM, Randy wrote: > It would only be used for detecting inbound UDP floods and other high PPS > anomalies so there is no need for full flows or even much details, just ip > src/dst.
It's useless for this or any other application because of the limitations of the EARL7. NetFlow isn't useful on 6500s until you get to Sup2T/DFC4. Also, there's no such thing as packet-sampled control of flow creation - i.e., 'sampled NetFlow' - on pre-Sup2T/DFC4 6500s. There's output flow sampling, which simply serves to make the non-determinisically-skewed, completely unreliable statistics even worse. Don't waste your time. Upgrade, or use probes on taps until you can upgrade. ----------------------------------------------------------------------- Roland Dobbins <[email protected]> // <http://www.arbornetworks.com> The basis of optimism is sheer terror. -- Oscar Wilde _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
