[c-nsp] SNMP Usage on Switchports vs. Router SubInterfaces

[Rick Kunkel]

Hello all,

We've currently got a bunch of machines hooked up to several 3550 and 2924
switches.  In most cases, each machine is owned by a different customer,
is connected to a different switchport, and is in it's own VLAN, connected
via an 802.1q trunk to a 7200 series router, which has a bunch of
GigaBitEthernet subinterfaces, one for each VLAN.  We're using RTG to
track usage through SNMP on the switchports.  The intent is to capture the
amount of traffic to the Internet they're using.  In the occasional case
where a customer has more than one switchport and they're passing a bunch
of traffic between these switchports, AFAIK our usage info is pretty much
useless.

My questions are these:

1.  If I collect SNMP data on the GigabitEthernet subinterfaces of the
7200 series router, will that more accurately reflect what I'm trying to
get?  Or, in other words, will it at least exclude the traffic that is
passing from switchport to switchport, because -- I think -- this traffic
never makes it up to the router's interface?

2.  Is there a better way to track this data?  How are others doing things
in cimilar situations?

3.  Related to above:  Should I be using NetFlow instead, and if so, what
open source tools are available for dealing wit this data?

Thanks much!

Rick Kunkel