Netflow extra traffic ?

[SmokeyBandid]

Does anybody have any examples of how much extra traffic netflow produces ?

 

[vipergg]

I don't think it produces little extra traffic , it adds a little overhead to the processor because it has to look at all the traffic and store them in a cacheand this also takes up some memory. It can be a useful tool when looking for virus outbreaks , it was our main tool for finding the infected hosts in last years virus outbreaks, slammer , etc.... We don't keep it turned on all the time however . If you use a management tool to collect the flows then it will add a little traffic but can't imagine it would be that much .

 

[SmokeyBandid]

Thanks for the reply Vipergg. I did some simple calculations and I noticed that my 72xx router has about 1000 flows. 1 netflow version 5 packet contains 30 flows. 1000/30 = 33 netflow packets a second. 1 netflow packet = 1,5k. So that's like 33x1,5 = about 50k/sec if the routers is busy. 50k extra traffic on a 256k line is ALOT of extra traffic.

I wish somebody could test it out. It's a risk if my service provider company activates netflow on the backbone routers (because all the routers are owned by another company called Infonet).

If the backbone traffic gets out of hand because of the extra netflow traffic of the routers then that could cost my company a lot of extra money and maybe some downtime.

And what would be the inpact on the router when a virus is spreading on the network, because it produces more flow and extra traffic of netflow...