R3303-HP HSR6800 Routers Network Management and Monitoring Configuration Guide

148
• NetStream collector (NSC)—The NSC is usually a program running in UNIX or Windows. It parses
the packets sent from the NDE, and then it stores the statistics to the database for the NDA. The NSC
gathers the data from multiple NDEs.
• NetStream data analyzer (NDA)—The NDA is a tool for analyzing network traffic. It collects
statistics from the NSC, and performs further processes, and generates various types of reports for
applications of traffic billing, network planning, and attack detection and monitoring. Typically, the
NDA features a Web-based system for users to easily obtain, view, and gather the data.
Figure 54 IPv6 NetStream system
As shown in Figure 54, IPv6 NetStream uses the following procedure to collect and analyze data:
1. The NDE, that is the device configured with IPv6 NetStream, periodically delivers the collected
statistics to the NSC.
2. The NSC processes the statistics, and then it sends the results to the NDA.
3. The NDA analyzes the statistics for accounting, network planning, and the like.
NSC and NDA are usually integrated into a NetStream server. This document focuses on the description
and configuration of the NDE.
IPv6 NetStream key technologies
Flow aging
IPv6 NetStream uses flow aging to enable the NDE to export IPv6 NetStream data to the NetStream
server. IPv6 NetStream creates an IPv6 NetStream entry for each flow in the cache, and each entry stores
the flow statistics. When the timer of the entry expires, the NDE exports the summarized data to the IPv6
NetStream server in a specific IPv6 NetStream version export format. For information about flow aging
types and configuration, see "Configuring IPv6 NetStream flow aging."
IPv6 NetStream data export
IPv6 NetStream traditional data export
IPv6 NetStream collects statistics about each flow and, when the entry timer expires, it exports the data
in each entry to the NetStream server.
The data includes statistics about each flow, but this method consumes more bandwidth and CPU than
the aggregation method, and it requires a large cache size. In most cases, not all statistics are necessary
for analysis.