[54204] in North American Network Operators' Group
Re: Alternative to NetFlow for Measuring Traffic flows
daemon@ATHENA.MIT.EDU (Joe Abley)
Mon Dec 16 22:39:33 2002
Date: Mon, 16 Dec 2002 22:37:30 -0500
Cc: "K. Scott Bethke" <kbethke@thruport.com>, nanog@merit.edu
To: Richard A Steenbergen <ras@e-gerbil.net>
From: Joe Abley <jabley@isc.org>
In-Reply-To: <20021217032838.GY56949@overlord.e-gerbil.net>
Errors-To: owner-nanog-outgoing@merit.edu
On Monday, Dec 16, 2002, at 22:28 Canada/Eastern, Richard A Steenbergen
wrote:
> On Mon, Dec 16, 2002 at 09:16:55PM -0500, K. Scott Bethke wrote:
>>
>> based on ALL the ASN's of the people on the peering switch.. but in
>> most
>> cases anyone pushing any real traffic will probably not have fine
>> grained
>> samples enough to determine a peering relationship based on a single
>> AS
>> with this method. Maybe Im wrong but hey if you are taking 200megs
>> from any
>> one ASN I would hope you knew about it.
>
> Also, that method has the same "knowing the routes" problem as netflow.
> Whereever you are getting your list of ASN's route ASN.*"'s routes,
> there
> is pretty much no way they are accurate (for an ASN of ANY size).
>
> You would have to statically route (or otherwise inject routes with a
> specific nexthop) a list of their customer prefixes that would have to
> be
> manually transmitted.
If you are interested in traffic *to* a particular destination, surely
you could just tweak localpref on routes based on an as-path filter?
If you are interested in traffic *from* a particular destination (you
have a network full of eyes, not content) then this approach is not
useful anyway.
Joe
