netflow behavior

L4 Transporter

netflow behavior

Is the session is long live ( some applications like nfs,panorama) will start and last till 1 month.

As we have configured log at session end, the log entry will be created once the session is ended.

However we have configured netflow as well.

Netflow is also reporting data to netflow server once the session ended on firewall ( which is 1 month later)

Is this beghavior correct for netflow, I was think it used to report every session information based on interval configured which around 30 min.

We are getting this information on netflow only after session ends. This is affecting for long duration sessions like 1 month.

Is there any parameters to tweak this behavior

Firewalldog dot com
Tags (1)
L7 Applicator

Re: netflow behavior

That is expected behavior.


Before the session ends, the values for things like duration and bytes would not be accurate later if you needed to investigate a particular flow. There wouldn't be an easy way to do delta calculations on the same session since that would require keeping a table of the various active sessions that were still active before, which would probably too much overhead.


You're right in that there is a delta reporting for your configured interval, but that serves to buffer requests and provide cadence. Since the session still didn't end in that interval, the firewall won't use that session until it is actually completed.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!