We suggest configure long aging time on 120 sec and normal aging time to 60 sec. Aging time is critical for network anomalies detection. 

The following IOS commands break up flows into shorter segments:

router(config)# ip flow-cache timeout active 2
router(config)# ip flow-cache timeout inactive 60

The following commands set up aging on native IOS device:

L3switch(config)# mls aging long 120
L3switch(config)# mls aging normal 60

The following commands set up agin on CatOS device:

switch> (enable) set mls agingtime long 128
switch> (enable) set mls agingtime 64