R3303-HP HSR6800 Routers Network Management and Monitoring Configuration Guide

132
• NetStream collector (NSC)—The NSC is usually a program running in UNIX or Windows. It parses
the packets sent from the NDE, and then it stores the statistics to the database for the NDA. The NSC
gathers the data from multiple NDEs, and then it filters and aggregates the total received data.
• NetStream data analyzer (NDA)—The NDA is a tool for analyzing network traffic. It collects
statistics from the NSC, performs further process, and generates various types of reports for
applications of traffic billing, network planning, and attack detection and monitoring. Typically, the
NDA features a Web-based system for users to easily obtain, view, and gather the data.
Figure 49 NetStream system
As shown in Figure 49, NetStream uses the following procedure to collect and analyze data:
1. The NDE, that is the device configured with NetStream, periodically delivers the collected statistics
to the NSC.
2. The NSC processes the statistics, and then it sends the results to the NDA.
3. The NDA analyzes the statistics for accounting, network planning, and the like.
NSC and NDA are usually integrated into a NetStream server. This document focuses on the description
and configuration of the NDE.
NetStream key technologies
Flow aging
NetStream uses the flow aging to enable the NDE to export NetStream data to the NetStream server.
NetStream creates a NetStream entry for each flow in the cache, and each entry stores the flow statistics.
When the timer of the entry expires, the NDE exports the summarized data to the NetStream server in a
specific NetStream version export format. For more information about flow aging types and configuration,
see "Configuring NetStream flow aging."
NetStream data export
NetStream traditional data export
NetStream collects statistics about each flow, and, when the entry timer expires, it exports the data in
each entry to the NetStream server.
The data includes statistics about each flow, but this method consumes more bandwidth and CPU than
the aggregation method, and it requires a large cache size. In most cases, not all statistics are necessary
for analysis.