We have a custom Netflow sensor that we use to collect 95% Mbps data by IP for client billing (we're a public web host). Each client has two channels assigned, data in and data out, and a matching Include filter. (the include filter is one line that encompasses all of the IPs from all defined channels). Like this:
Channels #1:Client_in (DestinationIP[22.214.171.124] or DestinationIP[126.96.36.199]) #2:Client_out (SourceIP[188.8.131.52] or SourceIP[184.108.40.206]) Incude filter (IP[220.127.116.11] or IP[18.104.22.168])
Our question is, are we hurting or helping machine performance by using the include filter since it is essentially a duplicate of the channel definitions?