[133225] in North American Network Operators' Group
Re: ipfix/netflow/sflow generator for Linux
daemon@ATHENA.MIT.EDU (Yiming Gong)
Mon Dec 6 16:46:11 2010
Date: Mon, 06 Dec 2010 15:45:33 -0600
From: Yiming Gong <yiming.gong@xo.com>
To: nanog@nanog.org
In-Reply-To: <!&!AAAAAAAAAAAYAAAAAAAAAF14xRJYlm1EkOxD1AqQStBCgQAAEAAAAM+R4/V/D8JCpJLSHOeeUQUBAAAAAA==@fuhell.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Try PMACCT, it is pretty handy.
Yiming
On 12/06/2010 01:15 PM, Thomas York wrote:
> At my current place of work, we use all Linux routers. I need to do some IP
> accounting/reporting and am currently trying to use Scrutinizer. Scrutinizer
> can use netstream, jstream, ipfix, netflow, and sflow data without qualms.
> My only issue is that I can't seem to find any good software for Linux that
> works with multiple interfaces to generate the flow information. I've tried
> ndsad, nprobe, softflowd, host sflow, and ipcad without much luck. Most of
> the software only works on one interface (which is useless as I need to do
> accounting for numerous interfaces).
>
>
>
> I've had the best luck with ipcad. The only thing that seems to not work
> with it is that it doesn't correctly give the interface number in the flow
> information. It refers to all interfaces as interface 65535. I've tried the
> config option for ipcad to map an interface directly to an SNMP interface
> ID, but that option of the config file seems to be ignored.
>
>
>
> Ntop functionally does exactly what I need, but it's extremely buggy. It
> segfaults after a few minutes, regardless of Linux distro or Ntop version.
> So..any ideas on what I can do to get good flow information from our Linux
> routers?
>
>
