Sampled NetFlow collects NetFlow data for a subset of traffic on the interface(s) being monitored. Instead of collecting every packet, Sampled NetFlow collects only 1 packet in every N number of packets.
Flow data from protocols like NetFlow are a very light load, typically less than 0.5% of total bandwidth consumption. But Sampled NetFlow helps lower CPU utilization (and to a lesser extent bandwidth) if these are concerns for your monitored device. The trade-off is you’ll lose a bit of granularity in your data. The loss is minimal but increases as your N value increases.
These are the NetFlow sample rates we recommend:
Data volume (95th percentile) | Recommended sampling rate |
< 25 Mb/s | 1 in 1 |
< 100 Mb/s | 1 in 128 |
< 400 Mb/s | 1 in 256 |
< 1 Gb/s | 1 in 512 |
< 5 Gb/s | 1 in 1024 |
< 25 Gb/s | 1 in 2048 |
* If you set a sampling rate on a device, you must set the same sampling rate for the device in Auvik.
What if my device doesn't support sampling?
If you don’t need it, just set a sampling rate of 1 in Auvik. If you need to apply it, then you should enable simulated sampling in Auvik and set the desired sampling rate. This way Auvik will apply the sampling as the device would do.