[88483] in North American Network Operators' Group
Re: Interesting netflow entry
daemon@ATHENA.MIT.EDU (Christopher L. Morrow)
Tue Feb 7 13:34:47 2006
Date: Tue, 07 Feb 2006 18:33:10 +0000 (GMT)
From: "Christopher L. Morrow" <christopher.morrow@verizonbusiness.com>
In-reply-to: <Pine.LNX.4.64.0602071318140.8783@odyssey.billn.net>
To: Bill Nash <billn@odyssey.billn.net>
Cc: Wil Schultz <wschultz@wilcomm.net>, nanog@nanog.org
Errors-To: owner-nanog@merit.edu
On Tue, 7 Feb 2006, Bill Nash wrote:
> Erm, that seems kind of low. Flow volume for two 6509s in what I consider
> a small to medium size hosting site, with about 6+ gigs of differentiated
> egress generates more than 8 to 9 *thousand* flows per second, and that's
> after discard incomplete tcp flows (port scans, half open syns, etc.)
>
> Are you sure you're getting everything?
he did previously state he was only using about 120mbps... and it'd depend
upon his/your sample rates as well...
