Aggregation

Version 8 allows the aggregation of flow data into larger, less granular flows. Use aggregation commands to specify the type of data to collect. These aggregation types are only applicable to flows that are exported to a Version 8 collector.

The following aggregation schemes are supported:

• AS matrix

  Flows are aggregated based on source and destination AS and ingress and egress interfaces.

• protocol-port

  Flows are aggregated based on the IP protocol, source port number, and destination port number.

• source prefix

  Flows are aggregated based on source prefix and mask, source AS, and ingress interface.

• destination prefix

  Flows are aggregated based on destination prefix and mask, destination AS, and egress interface.

• source-destination prefix

  Flows are aggregated based on source prefix and mask, destination prefix and mask, source and destination AS, ingress and egress interfaces.

• raw

  Flows are not aggregated and are sent to the collector in a Version 5 record.