[13894] in North American Network Operators' Group
Netflow IP accounting and IP protocol numbers
daemon@ATHENA.MIT.EDU (steven hessing)
Thu Nov 20 10:30:45 1997
To: nanog@merit.edu
Cc: netmaster@inet.unisource.nl
Date: Thu, 20 Nov 1997 16:22:17 +0100
From: steven hessing <stevenh@inet.unisource.nl>
The other day we started using Cisco netflow accounting software
together with IP flow export feature of recent Cisco IOS versions.
What we found was that although we put a lot of protocols in the
nfknown.protocols file of the accounting software (everywthing we
could find in the /etc/services file of Solaris and Linux), there
is still a lot of traffic under TCP-Other and UDP-Other. This
indicated that traffic is going over our network using ports that
the software doesn't know about.
This could for example be Real-audio, Cuseeme, Pointcast, Backweb
etc traffic. Unfortunately, I don't have a list of these newer
protocols together with their port numbers. Has anyone compiled
such a list? There's the Assigned numbers RFC but the last version
of it is RFC 1700 of October 1994.
-- Steven
