ng_netflow and router performance question

Ivan Alexandrovich ivsan at
Thu Oct 12 00:30:04 PDT 2006

On Wed, 11 Oct 2006 02:02:38 +0300
Alexander Motin <mav at> wrote:
> I think, that there is not very good hash function now used in ng_netflow 
>in traffic aggregation. So if
> > ip-addr varies from to
> means than destination address will vary in this range and all other 
>parameters is remain constant then it will be worst case possible.

Thanks for your help.
With pretty random src ip (10.0.*.* - 100.*.*.*) it was
able to handle 23K pkt/s of unique flows without
packet losses and with 99,96 accuracy (both active and
inactive timeouts were set to 3 seconds for testing

I'd like to ask about the reasonable values of
timeout parameters for a highly loaded router
to avoid records cache overruns?
There is a compile-time option CACHESIZE defined
in ng_netflow.h. Is it ok to increase it or should I
manipulate with timeout values alone?


More information about the freebsd-net mailing list