H3C Technologies H3C MSR 50 - Manual (Page 104)

• NetStream collector (NSC)—The NSC is usually a program running in UNIX or Windows. It parses
the packets sent from the NDE, and then it stores the statistics to the database for the NDA. The NSC
gathers the data from multiple NDEs, and then it filters and aggregates the total received data.
• NetStream data analyzer (NDA)—The NDA is a tool for analyzing network traffic. It collects
statistics from the NSC, performs further process, and generates various types of reports for
applications of traffic billing, network planning, and attack detection and monitoring. Typically, the
NDA features a Web-based system for users to easily obtain, view, and gather the data.
Figure 31 NetStream system
As shown in Figure 31 , NetStream uses the following procedure to collect and analyze data:
1. The NDE (the device configured with NetStream) periodically delivers the collected statistics to the
NSC.
2. The NSC processes the statistics, and then it sends the results to the NDA.
3. The NDA analyzes the statistics for accounting, network planning, and the like.
NSC and NDA are usually integrated into a NetStream server. This document focuses on the description
and configuration of the NDE.
NetStream key technologies
Flow aging
NetStream uses the flow aging to enable the NDE to export NetStream data to the NetStream server.
NetStream creates a NetStream entry for each flow in the cache, and each entry stores the flow statistics.
When the timer of the entry expires, the NDE exports the summarized data to the NetStream server in a
specific NetStream version export format. For more information about flow aging types and configuration,
see "
Configuring NetStream flow aging ."
NetStream data export
NetStream traditional data export
NetStream collects statistics about each flow, and, when the entry timer expires, it exports the data in
each entry to the NetStream server.
The data includes statistics about each flow, but this method consumes more bandwidth and CPU than
the aggregation method, and it requires a large cache size. In most cases, not all statistics are necessary
for analysis.
91