Let’s talk about NetFlow observation point in Cisco NetFlow capable devices, particularly the octetDeltaCount collection. Ingress and egress Netflow are probably notions we are the most familiar with. However, what exactly is Ingress or Egress NetFlow? At what point were bandwidth utilization values in my NetFlow report metered?
KEY TERMS
- Shaper: Is where traffic shaping occurs. Traffic shaping “allows you to control the traffic going out an interface in order to match its flow to the speed of the remote target interface and to ensure that the traffic conforms to policies contracted for it“, it is basically a process which modifies the traffic. This could be an Access Control List, Rate limiter, etc.
- MiddleBox Function: is the core function of the device. Example: Traffic Switching.
- OP(s): Observation Points
What is octetDeltaCount (ODC) ? “The number of octets since the previous report (if any) in incoming packets for this Flow at the Observation Point. The number of octets includes IP header(s) and IP payload.” If you were to look inside a NetFlow packet, octetDeltaCount represents the bandwidth utilization or the number of bytes associated with the flow.
What is postOctetDeltaCount (PODC) ?: Same as octetDeltaCount, “except that it reports a potentially modified value caused by a middlebox function after the packet passed the Observation Point.”
In Cisco’s implementation, octetDeltaCount is used for all ingress and egress flow export. As illustrated in the above diagram, there are 3 NetFlow Observation points: The initial traffic shaping process, The middlebox function, and the final traffic shaping process.
OP1: observes the ingress traffic towards the Middlebox function, and reports
- flowDirection :Ingress
- octetDeltaCount = ODC1
- postOctetDeltaCount = PODC1
OP2: observes the Middlebox function and reports.
- octetDeltaCount = ODC2 where ODC2 == PODC1
- There is no direction here.
- postOctetDeltaCount = PODC2
OP3: observes the egress traffic from the Middlebox function, and reports.
- flowDirection = Egress
- octetDeltaCount = ODC3 where ODC3 == PODC2.
- postOctetDeltaCount = PODC3
The Observation point for ingress is before the Middlebox and the Observation point for egress is after the MiddleBox. That is why Cisco uses octetDeltaCount (ODC3) for egress, at this point any necessary shaping to the traffic has been done (ODC3 == PODC2). Example: WAAS compression
Please add a comment, if you know vendors that are doing this differently?