In netflow we are somehow victim of our own success – we use netflow for many features. For example cisco router uses netflow in:

• NBAR2
• performance monitoring
• performance agent
• QoS
• PfR (performance routing)
• security
• WAAS

So we got multiple metering processes inside our routers. We are doing the same thing multiple times because we dont have any synchronized view what is happening on specific flows.

For that we use metric mediation agent infrastructure. What it does is it looks into all that features using netflow mechanism and aggregate the flow record.