[e2e] number of flows per unit time in routers

[Mike Fisk]

On Oct 28, 2005, at 11:41 AM, Craig Partridge wrote:

>
> Hi Bob:
>
> Sounds as if I need to provide a bit of context.  If you are tracking
> flows (imagine a router keeping track of flows, using, say something 
> like
> NetFlow), one question is how many flows do I need to keep track of.
> Another question is how fast may I have to create new flows or expire
> old flows.  Yet another question, and the one I was aiming at, is that
> if I'm archiving flow records over time, at what rate do I have to
> archive?

That adds another dimension, because frequently you are capturing flows 
from multiple routers at a single collection point.  For a "large 
campus environment" (including border routers), I capture and archive 
an average of 127 million flows per day with a max of 208 million per 
day.  A quick look (e.g. statistically unsound) during peak local 
activity (not during a DOS attack or anything special) shows as many as 
17,000 flows per second and 95,000 flows per minute.

Mike Fisk
Team Leader, Networked Systems Research, Los Alamos National Lab
See http://public.lanl.gov/mfisk/ for contact information