I’m at Cisco Live 2011 this week Showing off Scrutinizer v8.5 with JimmyD. It’s great to see Cisco showing off the new Catalyst 4948E NetFlow-Lite ‘NFlite’ exports using Scrutinizer NetFlow Analyzer and the nprobe.


NFlite is a sampling technology using NetFlow v9 where the following are configurable:

  • A sample rate of every 32nd packet onwards in multiples of 2 (It also supports 1 in 1 sampling on up to two 1G ports for troubleshooting purposes)
  • The number of packets sampled from a population (default = 1)
  • The interfaces to sample on
  • The length or portion of the packet sampled
  • The offset in the input sampled packet

The above reminds me of the proposed PSAMP (i.e. Packet Sampling) standard. I’ll digress on this in another blog.

Anyway, the samples are sent to an nProbe which can handle about 250,000 flows per second.  NFlite sends one sample per NetFlow datagram. The nprobe then compiles the data into aggregated traditional NetFlow datagrams and estimates the actual byte count and packet count for a given flow based on the sampling rate and information received in the samples. The orginal source IP address of the switch is ‘spoofed’ by the nprobe.  This tactic ensures that the NetFlow / IPFIX collector believes it received the datagrams directly from the switch.  This important in case the NetFlow reporting tool needs to SNMP query the switch.

You’ll also notice in the screen shot above the Nexus 7000 NetFlow exports.  Scrutinizer NetFlow Monitor is demonstrating the integrated view of NetFlow data from N7k and NetFlow-lite from the 4948E.

Luca Deri, the developer of the nprobe and Cisco have been kind enough to let our NetFlow developers work directly with them to ensure our compatibility with the new NetFlow exports. The nprobe and nbox can be purchased from ravica.com.

Mike Patterson author pic


Michael is one of the Co-founders and the former product manager for Scrutinizer. He enjoys many outdoor winter sports and often takes videos when he is snowmobiling, ice fishing or sledding with his kids. Cold weather and lots of snow make the best winters as far as he is concerned. Prior to starting Somix and Plixer, Mike worked in technical support at Cabletron Systems, acquired his Novell CNE and then moved to the training department for a few years. While in training he finished his Masters in Computer Information Systems from Southern New Hampshire University and then left technical training to pursue a new skill set in Professional Services. In 1998 he left the 'Tron' to start Somix which later became Plixer.


Big Data

Sankey Flow Graph

One of the greatest benefits of NetFlow collection for traffic analysis, is we’re provided with the ability to visualize the…

Leave a Reply