Cascade Profiler

[danieltt]

If the Router is on the outside of the Steelhead and the HTTP port 80 traffic is optimized then the Router will export this HTTP as port 7800 or 7810. With this in mind i would still expect de-dup for the 7800 traffic.

Within Cascade try creating a more accurate report by Interface.

Failing that,Try logging a support case with the Cascade escalation engineers. They are very good :.)

[sponge]

Edwin, To answer your question, Yes, it is a good thing to have, and I am already getting it from CascadeFlow. Its just that because it can't de-duplicate with the Netflow V9 session from the router, I get extra counting for flows. Of course that would not be a problem if I wasn't running close to my licensing cap. Thanks,

[sponge]

Thanks for the response. By optimization gains I mean that by using Cascade Flow on the Steelhead I get to show the WAN vs LAN and hence can show the optimization that the Riverbed is getting. Its a rather nice feature allowing me to show gains on a certain application across all sites and then drill down to any issues spotted. My problem is that the Cascade system cannot de-duplicate the WAN Netflow v9 from the router and the Cascade Flow from the Steelhead because is doesn't understand they are the same session (probably because the application may be on port 80 and the Steelehead turns this into port 7800). I can turn off the router Netflow if I know I am getting everything from the Cascade Flow, including traffic in bypass rules. I can use SNMP in other platforms to monitor interface statistics. I am running 9.0.5 of both gateway and profiler. Thanks

[danieltt]

Hi ,

      Cascadeflow and Netflow tend to be very accurate in providing the correct statistics.

Cascadeflow will provide the additonal visability and timing metrics (RTT) into the optimized port 7800 traffic.......standard neflow v9 templates cant do this.

I have seen some issues that related to reporting bugs on earlier release of Cascade code which have now been fixed however the Profiler should be de duplicating the additional flows from the Router and Steelhead. I would expect the port 7800 traffic should remain the same volume once de duped!

You will however see a increase in Flow export across the WAN from the additonal flow exporting devices.

We always export Cascadeflow where possible however it can be useful to export Netflow from the Routers as well to provide interface utilization information and so on.

Make sure you inactive and active timeouts on your Router match to

Active timeout setting for flows should be set to 60 sec (1 min).

Inactive timeout setting can be left at the default setting of 15 sec.

What do you mean by wanted to show optimization gains?

Thanks

[Edwin Groothuis]

Hello Andrew,

A quick counter-question:

If the details of an inner TCP channel of an optimized TCP session are not seen on your Netflow collector, are you properly monitoring your network?

Don't get rid of then, you will need them one day.

Edwin

[sponge]

OK, an odd situation. We used to run Netflow v9 from all my site routers. This worked very nicely. Then bought Steelheads to go at every site and we wanted to be able to show the optimization gains from the sites in Cascade so turned on CascadeFlow. Guess what - Now we get extra TCP sessions on port 7800 being reported from the Router seeing the TCP sessions from the Steelheads talking to each other. So, If Cascade flow reports on everything, including stuff in bypass then I can turn off the netflow from the routers (very little does not pass via the Steelhead). Is this the case? I can't find a statement that confirms either way. If I am not getting all the traffic from CascadeFlow, how can I filter out the intra-Steelhead flow information to stop my report having spurious data? Thanks, Andrew