[c-nsp] 'multiplexing" netflow?

Aaron Glenn aaron.glenn at gmail.com
Thu Jul 3 14:49:33 EDT 2008


On Thu, Jul 3, 2008 at 4:46 AM, Drew Weaver <drew.weaver at thenap.com> wrote:
> Now I remember why I can't use this (sorry it's been a while since I've examined this)
>
> The appliance we are sending our flows to can only handle maybe 1% of our actual flows (sampled) (and only from 2 out of 10 of our interfaces) I would like to send all of the flow data to another system for analysis.
>
> So basically I would need to send all of the flow data to a middle-man, and then have it configured to somehow know what to send where.

flow-fanout or, my recommendation, pmacct


More information about the cisco-nsp mailing list