The main flowc limitation is impossibility correct aggregation of tcp
connections based on client port number. As result, the netflow
database is large especially on heavy traffic routers.
This limitation is a feature of NetFlow technology, because it is not
possible to know, which side was an initiator of tcp connection. In case
if one tcp port is less than 1024, then this port is tcp server port
and another port belongs to tcp client. In this case the client port
number aggregation is possible. This feature significantly reduce the
netflow database size.
|