Re: [j-nsp] cflowd sampling

From: Mark Fullmer (maf@eng.oar.net)
Date: Fri Nov 09 2001 - 23:22:37 EST


On Fri, Nov 09, 2001 at 06:12:28PM -0600, Stephen Gill wrote:
>
> If using port-mirroring to send sampled traffic out to a collector
> server, does anyone know of any well-written efficient flow generators
> (not flow collectors)?

Slick feature.

It looks like there are a few things missing to use this for flow generation.
The input/output interface would need to show up in the mirrored traffic,
and the ability to only send the IP/TCP/UDP headers or headers + n bytes
of payload. Access to a few bytes of the payload would potentially allow
the collector/generator to make better guesses at the application.

mark



This archive was generated by hypermail 2b29 : Mon Aug 05 2002 - 10:42:37 EDT