We have a custom Netflow sensor that we use to collect 95% Mbps data by IP for client billing (we're a public web host). Each client has two channels assigned, data in and data out, and a matching Include filter. (the include filter is one line that encompasses all of the IPs from all defined channels). Like this:
Channels #1:Client_in (DestinationIP[184.108.40.206] or DestinationIP[220.127.116.11]) #2:Client_out (SourceIP[18.104.22.168] or SourceIP[22.214.171.124]) Incude filter (IP[126.96.36.199] or IP[188.8.131.52])
Our question is, are we hurting or helping machine performance by using the include filter since it is essentially a duplicate of the channel definitions?