[c-nsp] Netflow/NBAR (was: 6500 under DDoS)

[james edwards]

>>For netflow, Flow-tools at
> >http://www.splintered.net/sw/flow-tools/ is the bomb, the page has some
> >good links with examples and addon programs.


I have had good sucess for flow-tools. Avoid cflowd by CAIDA, it is no
longer developed and
I found it had a memory leak so large you could drive a mac truck through
it.

-- 
James H. Edwards
Routing and Security Administrator
At the Santa Fe Office: Internet at Cyber Mesa
jamesh at cybermesa.com
noc at cybermesa.com
(505) 795-7101