[50076] in North American Network Operators' Group
Re: Multi-collector Netflow/etc
daemon@ATHENA.MIT.EDU (Kurt Erik Lindqvist)
Thu Jul 18 04:39:29 2002
Date: Thu, 18 Jul 2002 10:35:26 +0200
From: Kurt Erik Lindqvist <kurtis@kurtis.pp.se>
Reply-To: Kurt Erik Lindqvist <kurtis@kurtis.pp.se>
To: "nanog@merit.edu" <nanog@merit.edu>
In-Reply-To: <Pine.LNX.4.33.0207171453550.2645-100000@minot.kruckenberg.com>
Errors-To: owner-nanog-outgoing@merit.edu
> Any other methods that are working for scaling multiple
> collectors without exceeding router limitations or burdening
> routers unnecessarily?
I know that we at some point had several machines in the network gathering
the data as the volumes simply became to much to process at one single
point. We then had some homegrown software that did pre-processing on the
data and this was then fed to the main processing server. However, in
general I think it's pretty hard to make Netflow data scale...ideally you
would be able to pick which fields you wanted exported...
If you find some "standard" tool set for this, I think would be interesting
though. But I personalyl still think the problem lays with the protocol as
such...
- kurtis -
