H3C Technologies H3C SecBlade NetStream Cards - Manual (Page 157)

142
NetStream aggregation data export, which decreases the bandwidth usage compared to traditional
data export.
For example, the aggregation mode configured on the NDE is protocol-port, which means to aggregate
statistics of flow entries by protocol number, source port and destination port. Four NetStream entries
record four TCP flows with the same destination address, source port and destination port but different
source addresses. According to the aggregation mode, only one NetStream aggregation flow is created
and sent to the NetStream server.
Table 12 lists the aggregation mode that the device supports. In the mode, the system merges flows into
one aggregation flow if the aggregation criteria are of the same value.
Table 12 NetStream aggregation mode
Aggregation mode Aggregation criteria
Protocol-port aggregation
• Protocol number
• Source port
• Destination port
NetStream export formats
NetStream exports data in UDP datagrams in one of the following formats: version 5 and version 9.
• Version 5: Exports original statistics collected based on the 7-tuple elements. The packet format is
fixed and cannot be extended flexibly.
• Version 9: The most flexible format. It allows users to define templates with different statistics fields.
NOTE:
IPv6 NetStream exports data in UDP datagrams in version 9 format only.
NetStream sampling and filtering
NOTE:
IPv6 NetStream does not support NetStream sampling and filtering.
NetStream filtering
NetStream filtering is implemented by referencing an access control list (ACL) to NetStream. NetStream
filtering enables NetStream module to collect statistics on packets that match the criteria. The filtering
allows for selecting specific data flows for statistics purpose.
NetStream sampling
A sampler provides the packet sampling function. A sampler selects a packet out of sequential packets,
and sends it to the service module for processing.
The following sampling modes are available:
• Fixed mode—The first packet is selected out of a number of sequential packets in each sampling.