H3C Technologies H3C SR8800 - Manual (Page 147)

135
When the timer of the entry expires, the NDE exports the summarized data to the NetStream server in
a specific NetStream version export format.
The following types of NetStream flow aging are available:
• Periodical aging
• Forced aging
• TCP FIN- and RST-triggered aging (it is automatically triggered when a TCP connection is
terminated)
Periodical aging
Periodical aging uses these approaches: inactive flow aging and active flowing aging.
• Inactive flow aging
A flow is considered inactive if its statistics have not been changed, that is, no packet for this
NetStream entry arrives in the time specified by the ip netstream timeout inactive command. The
inactive flow entry remains in the cache until the inactive timer expires. Then the inactive flow is
aged out and its statistics, which can no longer be displayed by the display ip netstream cache
command, are sent to the NetStream server. The inactive flow aging guarantees the cache is big
enough for new flow entries.
• Active flow aging
An active flow is aged out when the time specified by the ip netstream timeout active command is
reached, and its statistics are exported to the NetStream server. The device continues to count the
active flow statistics, which can be displayed by the display ip netstream cache command. The
active flow aging exports the statistics of active flows to the NetStream server.
Forced aging
The reset ip netstream statistics command ages out all NetStream entries in the cache and clears the
statistics. This is forced aging. Alternatively, use the ip netstream max-entry command to configure aging
out of entries in the cache when the maximum number of entries is reached.
TCP FIN- and RST-triggered aging
For a TCP connection, when a packet with a FIN or RST flag is sent out, it means that a session is finished.
When a packet with a FIN or RST flag is recorded for a flow with the NetStream entry already created,
the flow is aged out immediately. This type of aging is enabled by default, and cannot be disabled.
NetStream data export
NetStream common data export
The NetStream collects statistics of each flow and, when the entry timer expires, exports the data of each
entry to the NetStream server.
Though the data includes statistics of each flow, this method consumes more bandwidth and CPU, and
requires large cache size. In most cases, not all the statistics are necessary for analysis.
NetStream aggregation data export
The NetStream aggregation merges the flow statistics according to the aggregation criteria of an
aggregation mode, and sends the summarized data to the NetStream server. This process is the
NetStream aggregation data export, which decreases the bandwidth usage compared to common data
export.