Cisco NetFlow – Define Input and Output in Flexible NetFlow

cisconetflowroutingswitch

I am trying to understand the definition of "input" and "output" traffic to an interface.

Below is extracted from Flexible NetFlow Documentation in Cisco 3850 ->

If you apply a flow monitor in the input direction:
• Use the match
keyword and use the input interface as a key field.
• Use the
collect keyword and use the output interface as a collect field. This
field will be present in the exported records but with a value of 0.

• If you apply a flow monitor in the output direction:
• Use the
match keyword and use the output interface as a key field.
• Use
the collect keyword and use the input interface as a collect field.
This field will be present in the exported records but with a value of
0.

  1. When traffic ingresses into Gi1/0/1 and needs to egress out of
    gi1/0/2, is that traffic considered as "input" or "output" to
    gi1/0/2?
  2. I can't twist my head around on why, if I apply a flow in the input
    direction, I have to collect output interface, and that field will
    be value 0?

Best Answer

You need to understand in which direction you want to collect information. Normally, you only want to collect statistics in a single direction, either input or output, but not both. Collecting information in both directions will double-count your traffic. Many people start out trying to collect both input and output on every interface, but find that doesn't really give them a good picture.

For example, if you only have input collection on a router's interfaces, you will be counting all traffic entering the router, and your traffic will only be counted once. If you have both input and output collection on a router, then traffic will be counted as it enters the router and again when it leaves the router, and this can distort your statistics, making it look like your router is routing twice as much traffic.

Related Topic