How do you know if the NetFlow collector is saving or even getting all of the NetFlow datagrams that are being sent to it or that it is receiving? It is important to know if any flows are missing.

Why do we care?

This is a great question. We care because a loss of flow exports is usually caused by one of three things:

1. The network dropped some packets
2. The router can’t keep up
3. The NetFlow receiver / collector can’t keep up

NetFlow sequence numbers are becoming increasingly important. When building a NetFlow collector it is important that the engine scales while staying accountable. If you look at the NetFlow v9 packet format you will notice something called the package_sequence.

Read more »

A NetFlow collector that can scan is important for many of our larger customers. Nearly 500 of our customers are collecting Cisco NetFlow and/or sFlow from over 100 devices. We understand that a NetFlow analyzer solution that can scale is important.

Scrutinizer Scales
I was working with a government customer last week. Check out the vitals on his Scrutinizer, which is receiving NetFlow from 440 routers with a combined 1736 interfaces. You might be surprise how often I see a huge volume of routers and a fairly light aggregate NetFlow volume. As you can see, Scrutinizer was chugging right along.

Read more »

Michael Patterson
Scrutinizer Product Manager
Follow Me on Twitter