Flow Type Considerations

A Bluecoat Packeteer shaper supports flow-detail-records v2 (FDR) for application identifier collection. FDR records include information beyond that included in basic NetFlow including Layer-7 application information. The NetProfiler understands these records.

If the device is a SteelHead, Riverbed recommends that you use SteelFlow Net instead of NetFlow to collect additional metrics, such as Layer-7 DPI, retransmit, and response time information. If the device supports multiple types of flow formats, NetFlow is preferable to sFlow.

Riverbed recommends that you use NetFlow v9 with TTL and that you export the TTL field so that network segment graphs are available in the NetProfiler. If NetFlow v9 is not available, use NetFlow v5.

Flow coalescing (also known as deduplication) is the process in which flows reported by different devices merge together into a single record. The NetProfiler and NetExpress merge records from the NetSharks and SteelHeads, NetFlow sources (routers, switches, and so on), and IPFIX sources and then tracks all the interfaces the flow crosses and any changes in traffic volume.

Flow coalescing does not occur between sFlow or sampled NetFlow sources and other flow types. These flow records do not merge with other record types (SteelFlow Net, IPFIX, NetFlow, and so on) because this data is sampled. You can have data inconsistencies if sFlow is merged with nonsampled sources. When you want to see sFlow or NetFlow reported conversations, make sure that your traffic query includes the source device of the flow to ensure the information is reported as accurately as possible.