Editing NetFlow (section)

=== Sampled NetFlow ===

Standard NetFlow was designed to process all IP packets on an interface.  But in some environments, e.g. on Internet backbones, that was too costly, due to the extra processing required for each packet, and large number of simultaneous flows.

So Cisco introduced sampled NetFlow on Cisco [[Cisco 12000|12000]], and that is now used in all high-end routers that implement NetFlow.

Only one packet out of ''n'' is processed, where ''n'', the sampling rate, is determined by the router configuration.

The exact selection process depends on the implementation:
* One packet every ''n'' packet, in Deterministic NetFlow, as used on Cisco's [[Cisco 12000|12000]].
* One packet randomly selected in an interval of ''n'' packet, in Random Sampled NetFlow, used on modern Cisco routers.

Some implementations have more complex methods to sample packets, like per-flow sampling on Cisco Martinez Catalysts.

The sampling rate is often the same for all interfaces, but can be adjusted per interface for some routers.
When Sampled NetFlow is used, the NetFlow records must be adjusted for the effect of sampling - traffic volumes, in particular, are now an estimate rather than the actual measured flow volume.

The sampling rate is indicated in a header field of NetFlow version 5 (same sampling rate for all interfaces) or in option records of NetFlow version 9 (sampling rate per interface)