NetStream Flow Statistics Exporting

The NDE exports flow statistics to a specified NSC for further analysis after the flows age in the NetStream cache.

Flow Statistics Exporting Modes

Original flow statistics exporting

The NDE collects statistics about all flows in original flow statistics exporting mode, and will export statistics about each flow to the NetStream server after the aging timer expires.

This mode enables the NetStream server to obtain detailed statistics about each flow, but increases network bandwidth and CPU usage. The statistics also occupy more memory on the NDE, which increases cost.

Aggregation flow statistics exporting

When in aggregation mode, the NDE aggregates flow statistics with the same aggregation entry values and then exports them to a specified NetStream server, significantly saving network bandwidth. The NDE supports the aggregation modes described in Table 1.

For example, when there are four original TCP flows that have the same source port number, destination port number, and destination IP address, but different source IP addresses, the protocol-port mode is used. Aggregation entries in this mode include:

Protocol number
Source port number
Destination port number

Because the four TCP flows from the example have the same protocol number, source port number, and destination port number, only one aggregation flow statistics record is recorded in the aggregation flow statistics table.

**Table 1** Aggregation modes
Aggregation Mode	Aggregation Entries
as	Source AS number, destination AS number, index of the inbound interface, and index of the outbound interface
as-tos	Source AS number, destination AS number, inbound interface index, outbound interface index, and ToS
protocol-port	Protocol number, source port number, and destination port number
protocol-port-tos	Protocol number, source port number, destination port number, ToS, inbound interface index, and outbound interface index
source-prefix	Source AS number, source mask length, source prefix, and inbound interface index
source-prefix-tos	Source AS number, source mask length, source prefix, ToS, and inbound interface index
destination-prefix	Destination AS number, destination mask length, destination prefix, and outbound interface index
destination-prefix-tos	Destination AS number, destination mask length, destination prefix, ToS, and outbound interface index
prefix	Source AS number, destination AS number, source mask length, destination mask length, source prefix, destination prefix, inbound interface index, and outbound interface index
prefix-tos	Source AS number, destination AS number, source mask length, destination mask length, source prefix, destination prefix, ToS, inbound interface index, and outbound interface index

Flexible flow statistics exporting

Flexible flows are created based on customized configurations. Users can collect flow statistics as required based on the:

Protocol type
DSCP field
Source IP address
Destination IP address
Source port number
Destination port number
IPv6 flow label
TTL value
VLAN ID
Source MAC address
Destination MAC address

The NDE exports the flow statistics to the NetStream server. Flexible flow statistics exporting occupies less traffic than original flow statistics exporting and provides users with a flexible way to collect NetStream statistics.

Versions of Exported Packets

NetStream exported packets are transmitted using UDP and have the following versions:

V5: NetStream packets use a fixed format and contain the original flow statistics collected based on 7-tuple information.
V8: NetStream packets use a fixed format and support the aggregation exporting format.
V9: NetStream packets are defined in profiles and support the exporting of BGP next hop. Statistical items can be combined, allowing more flexibility for exporting statistics.

Other versions are in the experimental stage and have not been released for commercial use.