topic Re: netflow behavior in General Topics

netflow behavior

Roby_Sreejith — Thu, 05 Jul 2018 14:53:45 GMT

Is the session is long live ( some applications like nfs,panorama) will start and last till 1 month.

As we have configured log at session end, the log entry will be created once the session is ended.

However we have configured netflow as well.

Netflow is also reporting data to netflow server once the session ended on firewall ( which is 1 month later)

Is this beghavior correct for netflow, I was think it used to report every session information based on interval configured which around 30 min.

We are getting this information on netflow only after session ends. This is affecting for long duration sessions like 1 month.

Is there any parameters to tweak this behavior

Re: netflow behavior

gwesson — Thu, 05 Jul 2018 21:40:11 GMT

That is expected behavior.

Before the session ends, the values for things like duration and bytes would not be accurate later if you needed to investigate a particular flow. There wouldn't be an easy way to do delta calculations on the same session since that would require keeping a table of the various active sessions that were still active before, which would probably too much overhead.

You're right in that there is a delta reporting for your configured interval, but that serves to buffer requests and provide cadence. Since the session still didn't end in that interval, the firewall won't use that session until it is actually completed.