Random Netflow – A Tool to Keep in Your Kit

In my network management adventures throughout the years, I’ve found Netflow to be an invaluable tool to troubleshoot a range of network issues – from bandwidth to service and resource problems. It’s an amazing traffic mining tool – it analyzes traffic flows across a network and provides a huge amount of information. That is where the problem lies as well – sometimes Netflow delivers too much information when I just want a small amount data for planning and traffic engineering. I’m sure you’ve come across this issue – right?

I know I’m not the only one, since I came across a great article from Network World on how to solve this issue. The advice is very straight forward and concise on how to solve the information overload issue by using the random Netflow feature. Thought it was worth sharing.

A few of my favorite tips from the article:

- Know your flow. Netflow versions 5 or 9 work if you need to export the data to look at it off device. With other versions you can view the data on the device.

- You can not have Netflow enabled on an interface you want to run random Netflow on. A device always gives full Netflow precedence over random Netflow.

- If you run into any problems there is a debug command: debug flow-sampler.

What was your favorite tip? Or if you have one that isn’t mentioned, I’d love to hear it!