22 May
2002
22 May
'02
10:14 a.m.
Based on our testing it looks like it all has to do with packet size. With small packets the throughput is very low. With what Cisco calls an "internet mix" of packet sizes throughput is much better. When doing max MTU packets, the throughput is of course the best.
The other thing I've found about traffic type is how sensitive netflow is. I was running it for a while, then I got a co-lo customer that had a lot of UDP traffic with small packet sizes and rarely more than a few packets between the same src/dest ip/port (much like DNS queries). It was enough to flatline the box and cause it to crash. -Ralph