Re: Netflow question

The answer depends on couple of things. Is there any other traffic from
branches, other than the traffic reaching the central site? What's
in-between and how much traffic is being dropped there? Having "egress"
configured on HQ and "ingress" on BR could in theory give you an indicator
of how much traffic is being dropped and discrepancy of certain percentage
could be used in proactive monitoring. Just a thought.

Most of the collectors I've seen are quite capable of generating statistics
based on the source where they received the flows from, but yes, you will
in theory have duplicate data.

--
Marko Milivojevic - CCIE #18427 (SP R&S)
Senior CCIE Instructor - IPexpert
On Fri, Apr 6, 2012 at 06:04, Pratik Gotecha <pgotecha4_at_gmail.com> wrote:
> Hello Experts,
>
> Had a quick question on Netflow...
>
> Right now I have "ip flow ingress" configured on all of my remote branch
> office devices. If i configure "ip flow egress" on my outgoing WAN router,
> which is connecting to these branch rotuers, and remove ip flow ingress on
> remote routers, would this solution work? Would I get the same output on
> the collector.
>
> Also if i keep both, i.e "ip flow egress" on the wan interface and on all
> other remote end routers "ip flow ingress" would this lead to double
> polling and get me incorrect counts on the collector?
>
>
> Blogs and organic groups at http://www.ccie.net
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html
Blogs and organic groups at http://www.ccie.net