If you're using netflow v9 or flexible netflow there are some cautions about using 'egress' together with 'ingress'.
There are some very good write-ups on this. Google-fu: 'netflow egress monitoring' Joe From: Scott Granados <[email protected]> To: "[email protected]" <[email protected]> Date: 05/21/2014 02:39 PM Subject: [c-nsp] more net flow, which interfaces to monitor and in which direction? Sent by: "cisco-nsp" <[email protected]> Hi, First, thanks for all the great input on analyzers and their strong and weak points. It looks like from the comments I’m going to give nfsen a shot. My followup question concerns selection of interfaces and the direction to monitor. While googling I find that almost all examples I find are sampling in the input direction only. Also most of the examples out there seem to be quite simple and involve one interface or a few. In the case where you might have many interfaces geographically diverse facing transit providers and you might have non symmetric routing is there some sort of science to what you monitor and in what direction? Is there an advantage to monitoring input flows only and if so what do you do to measure output? Any pointers on interface selection and configuration would be most appreciated. I’ve been googling but haven’t found much more than sampling on single or a few interfaces in one direction. Thanks Scott _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
