Question

A service provider is deploying flow monitoring on a Cisco IOS XR router with several 100GbE core-facing interfaces. The network team reports that enabling full 1:1 flow accounting on these interfaces caused elevated CPU/NPU load and dropped flow records. They must retain statistically meaningful traffic visibility while reducing the volume of flows processed and exported. Which configuration approach best meets these requirements?

Accepted Answer

Apply a sampler-map with a 1-out-of-N random sampling rate and reference it on the interface's flow monitor configuration

Answer

Reduce the active flow timeout to 1 second so flows are exported faster and cleared from the cache

Answer

Switch the export protocol from IPFIX to NetFlow v5 to reduce per-record overhead

Answer

Disable the flow cache and export every packet directly to the collector in real time