LIVEACTION, INC. Flow Sampling for ASR1K CONFIGURATION LiveAction, Inc. 3500 Copyright WEST BAYSHORE 2016 LiveAction, ROAD Inc. All rights reserved. LiveAction, LiveNX, LiveUX, the LiveAction Logo and PALO LiveAction ALTO, CA Software 94303 are trademarks of LiveAction, Inc. Information subject to change without notice.
Summary LiveAction Flow Sampling is an automatic mechanism to apply the sample rate to data that is aggregated in LiveAction to achieve the estimated bandwidth on the device. Flow Sampling on a network device is beneficial to save CPU processing, due to the high volume that the device is handling. Sampling is a flow configuration that specifies the sampling algorithm, the sampling rate (i.e. 1 out of 10 flows), and can be applied to one or more interfaces (ingress and/or egress). See http://www.cisco.com/c/en/us/td/docs/ios/fnetflow/configuration/guide/12_2sr/fnf_12_2_sr_book/use_ fnflow_redce_cpu.html for more information about sampling and how to configure it. If you have any questions about this guide, or need any assistance in general please contact LiveAction support: support@liveaction.com 1-1 Flow Sampling for ASR1K
Required Device Configurations LiveAction utilizes the information about the sampling configuration exported via the flow option records and data records to dynamically calculate the estimated bandwidths. These both must be configured for LiveAction to calculate the estimated bandwidth correctly. Flow Configuration Changes required to utilize flow sampler information highlighted in red. In this example, we are sampling one out of ten flows on the GigabitEthernet0/0/1 interface. Flow record LIVEACTION-FLOWRECORD description DO NOT MODIFY. USED BY LIVEACTION. match ipv4 tos match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port match interface input match flow direction collect routing source as collect routing destination as collect routing next-hop address ipv4 collect ipv4 dscp collect ipv4 id collect ipv4 source prefix collect ipv4 source mask collect ipv4 destination mask collect transport tcp flags collect interface output collect flow sampler collect counter bytes collect counter packets collect timestamp sys-uptime first collect timestamp sys-uptime last collect application name flow exporter LIVEACTION-FLOWEXPORTER description DO NOT MODIFY. USED BY LIVEACTION. destination 172.17.101.141 source GigabitEthernet0/0/3 transport udp 2055 option interface-table option sampler-table option application-table sampler asr1k-sampler description asr100k sampler mode random 1 out-of 10 interface GigabitEthernet0/0/1 ip address 10.128.128.1 255.255.255.0 ip nbar protocol-discovery ip flow monitor LIVEACTION-FLOWMONITOR sampler asr1k-sampler input ip flow monitor LIVEACTION-FLOWMONITOR sampler asr1k-sampler output negotiation auto 1-2 Flow Sampling for ASR1K
Options Template Overview NetFlow version 9 is a template-based version. The templates provide an extensible design to the record format. This feature allows enhancements to NetFlow services without requiring concurrent changes to the basic flow-record format. An options template is a special type of template record that is used to communicate the format of data related to the NetFlow process. Rather than supplying information about IP flows, the options are used to supply metadata about the NetFlow process itself. The sampler options template and the interface options template are different forms of options templates. The sampler options template consists of sampler tables. Similarly, the interface option templates consist of interface tables. By enabling the options for sampler table and interface table, it becomes easier for the collector to determine the information on data flow. The sampler table consists of information on the active samplers. It is used by the collector to estimate the sampling rate for each data flow. The sampler table consists of the following information for each sampler: Field Name Value FlowSamplerID This ID is assigned to the sampler. It is used by the collector to retrieve information about the sampler for a data flow record. FlowSamplerMode This field indicates the mode in which the sampling has been performed. The default value for this field is 1 for deterministic sampling and 2 for random sampling. FlowSamplerRandomInterval This field indicates the rate at which the sampling is performed. SamplerName This field indicates the name of the sampler. The interface table consists of information on interfaces that are being monitored for data flow. By using this information, the collector determines the names of interfaces associated with the data flow. The interface table consists of the following information: Field Name Value ingressinterface This field indicates the SNMP index assigned to the interface. By matching this value to the Ingress interface and the Egress Interface in the data flow record, the collector is able to retrieve the name of the interface. interfacedescription This field indicates the name of the interface 1-3 Flow Sampling for ASR1K
Screenshots with Description The Flow Device view shows the raw Flow records received by LiveAction. We do not use the sampler multiplier in this view. The Flow Interface view shows the aggregated information of the raw flows. We do not use the sampler multiplier here. 1-4 Flow Sampling for ASR1K
The Flow Reports will utilize the flow sampler multiplier provided by the sampler-options and the flow records. It multiplies the received flow bytes and packets by the multiplier to give a more accurate bandwidth. This is all done dynamically based on the configuration and flow records and options. The flow sampler multiplication is also available in the Flow Dashboard. 1-5 Flow Sampling for ASR1K
The following screenshot confirms that the byte count provided in the Flow Dashboard is correctly multiplied. Copyright 2016 LiveAction, Inc. All rights reserved. LiveAction, LiveNX, LiveUX, the LiveAction Logo and LiveAction Software are trademarks of LiveAction, Inc. Information subject to change without notice.