I am using Netflow v9 sensors to receive Netflow data.

The device does not use sampling and the active flow timeout is 30 minutes, which is the default value of the device. In the sensor setup, the scanning interval is 60 seconds and the active flow timeout is 31 minutes.

Are the values collected in Top Talker and Top Connections based on real-time analysis?

Does a netflow sensor discard Netflow packets longer than 31 minutes?

Article Comments

Hello Jonathan,

Regarding your questions, I invite you to have a look to our KB article about Active Flow Timeout: https://helpdesk.paessler.com/en/support/solutions/articles/76000041697-what-is-the-active-flow-timeout-in-flow-sensors

If you have further questions, let us know.

Regards.


Mar, 2021 - Permalink

Hi, Florian Lesage

The article you mentioned is helpful, but there's no answer I'm looking for.

Please kindly answer the questions below.

Are the values displayed in Top Talker and Top Connections based on real-time analysis?

After receiving all Netflow data continuously, does netflow sensor calculate and refresh the live data at every scanning interval?

Thanks, Jonathan Jung


Mar, 2021 - Permalink

Hi Jonathan,

At each scanning interval, the top lists (Top connection, top protocols, etc.) will indeed be updated with the data received by the sensor. As indicated in the KB article, the flows are segmented into small flows which are processed at each scan interval, allowing to get live-data instead of waiting for the end of data transmission between devices which could take some time.

Regards.


Mar, 2021 - Permalink