A user of a NetFlow reporting tool shouldn’t concern him or herself with whether or not the router or switch is exporting ingress, egress or both on a specific interface. Proper design of the NetFlow Analysis program should take this into account for the end user. Many NetFlow Analyzers exaggerate traffic if both ingress and egress is enabled. This can cause duplication of data and ultimately lead to trends that exaggerate the truth! Read more »

Michael Patterson
Scrutinizer Product Manager
Follow Me on Twitter

Scrutinizer v7.2 NetFlow and sFlow Analyzer has been released.  A complete log on the updates is on our web site.  The migration from v6.X to v7.2 is also done. Please contact plixer +1 (207) 324-8805 for assistance on the migration. 

We are offering 2 webcasts to cover many of the new features for Network Traffic Analysis. Read more »

Michael Patterson
Scrutinizer Product Manager
Follow Me on Twitter

Reporting on traffic impacted by Cisco WAAS using NetFlow requires the use of egress flow in NetFlow v9. Consider the diagram below where the traffic going in on interface 1 should be compressed by WAAS before it leaves on Interface 3:

Read more »

Michael Patterson
Scrutinizer Product Manager
Follow Me on Twitter

This is part 4 of an 4-part series (so far 4 parts) on the ToS field (i.e. Differentiated Services Field) of IP frames. I finally get into how all this relates to NetFlow in 2009.  Make sure you have already read Part 1, Part 2 and Part 3 of this blog.

ToS and DSCP part 4
At the end of Part 3 of this blog series I digressed very briefly on how CBQoS can be used to modify DSCP values on packets which come into the router.  In other words, VoIP traffic that comes in on ports 4569 and 5060 could enter a router with one DSCP value 0×00 and leave with a completely different one e.g. 0xEF (i.e. 11101111).    Read more »

Michael Patterson
Scrutinizer Product Manager
Follow Me on Twitter