About Traffic Analytics
The Traffic Analytics feature has the following capabilities:
-
Provides an ability to identify services provided by servers behind a switch to provide aggregated analytics data. To identify Server and Client, TCP Flags in a three-way handshake are used.
-
Collapses multiple TCP sessions from a client to a server or server to client into one record in the show flow cache database and exports the same to the collector.
A flow is defined by the source interface, protocol, source IP address, source port, destination IP address, and destination port values. If traffic analytics is enabled, the flows of TCP sessions are aggregated based on source IP address (SIP), destination IP address (DIP), source port (SP) for server to client traffic and SIP, DIP, destination port (DP) for client to server traffic.
Aging of Traffic Database Entries
The traffic database entries will be monitored every 24 hours using a timer. If there is no traffic hitting a database entry, then within 24 to 48 hours that traffic database entry will be deleted. By default the size of the database is 5000.
Troubleshooting Rules
The Troubleshooting rules are used to debug a flow by programming an analytics ACL filter. These rules take precedence over the traffic analytics rules and can be used for capturing specific flow. Troubleshooting rules might result in two entries in the flow cache.
Troubleshooting rules should be used only for specific flows preferably host for short duration only.