NetFlow and IPFIX Sampling: Configuration and Rates

Full NetFlow on a 400G uplink exports more telemetry than most collectors can ingest, which is why every serious deployment samples. Sampling also changes the meaning of the numbers: a flow that says 1 packet out of 1,000 means the collector must multiply, and the accuracy of that multiplication depends on how randomly the packets were chosen. This article covers sampler configuration on IOS-XR and IOS-XE, the rates that are actually supported, and how to sanity-check what the collector is receiving.

What sampling does to a flow record

A sampler selects one packet out of every n, and only the selected packets create or update flow entries. The router stamps the export with the sampling mode and interval so the collector can scale the counters back up. The two consequences to keep in mind:

• Sampling reduces export volume and CPU load roughly in proportion to the rate, at the cost of accuracy on very short flows.
• A flow must have at least one sampled packet to exist at all. With 1-in-32,000 sampling, a five-packet flow is statistically invisible.

Configuring a sampler on IOS-XR

Router# configure
Router(config)# sampler-map fsm1
Router(config-sm)# random 1 out-of 1000
Router(config-sm)# exit
Router(config)# commit

The sampler is then attached to the interface together with a flow monitor:

Router(config)# flow exporter-map fem1
Router(config-fem)# destination 10.1.1.1
Router(config-fem)# source Loopback0
Router(config-fem)# transport udp 2055
Router(config-fem)# version ipfix
Router(config-fem)# exit

Router(config)# flow monitor-map fmm1
Router(config-fmm)# record ipv4
Router(config-fmm)# exporter fem1
Router(config-fmm)# cache entries 10000
Router(config-fmm)# cache timeout active 1800
Router(config-fmm)# cache timeout inactive 15
Router(config-fmm)# exit

Router(config)# interface GigabitEthernet0/1/0/0
Router(config-if)# flow ipv4 monitor fmm1 sampler fsm1 ingress

Points that decide whether this works in production:

• Exporter version consistency — if several monitor maps share one collector, all exporter maps should use the same version, v9 or IPFIX, otherwise the collector sees mixed templates.
• Sampler scale limits — some platforms support only one active sampler per system, and only a small number of sampler maps applied at once across the chassis. Check the platform limits before designing a per-interface sampling scheme.
• Cache timeouts — an active timeout of 1,800 seconds and an inactive timeout of 15 seconds is a reasonable starting point; shorter inactive timeouts export more records and increase collector load.

Choosing the sampling rate

The supported maximum is tied to the hardware cache size: with a default cache of 65,535 entries the platform can accept sampling up to roughly 1 out of 65,535, while a recommended production rate is 1 out of 32,000. Rates beyond the platform's limit are rejected at commit, so a failed configuration is more often a scale limit than a syntax error.

IOS-XE alternative

configure terminal
 flow-sampler-map mysampler1 mode random one-out-of 100
 exit

On IOS-XE the sampler map is globally named and applied with ip flow monitor <name> sampler <sampler> input. Random Sampled NetFlow processes one randomly selected packet out of every n, and its principal uses are traffic engineering and capacity planning rather than billing-grade accounting.

Verification

show flow exporter-map
show flow monitor-map
show sampler-map
show flow monitor fmm1 cache format table
show flow exporter statistics

The Sampler Map section of the exporter output reports the mode and rate as configured — for example "Mode: Random (1 out of 262144 Pkts)" — which is the fastest way to catch a rate that was accepted but is not the rate you intended. On the collector side, compare the exported flow count against interface packet rates multiplied by the sampling interval; a collector receiving far fewer flows than the maths suggests is missing exports, not traffic.

Design guidance

• Sample on high-rate uplinks, monitor unsampled only where the volume is genuinely manageable.
• Keep the sampling rate uniform across the fabric so collector-side aggregation stays meaningful.
• Export to a dedicated collector interface, not the management VRF shared with syslog — a flow export burst can starve your logs.
• Record the sampling rate in your capacity reports; an unscaled sampled count is a common and expensive reporting error.

See also: NetFlow, IPFIX and sFlow compared, IOS-XR telemetry with MDT, and sFlow vs NetFlow vs IPFIX.

原文链接：https://www.cisco.com/c/en/us/td/docs/iosxr/cisco8000/netflow/configuration/b-netflow-configuration-ios-xr-8000/monitor-traffic-using-netflow.pdf