[c-nsp] NetFlow for Bandwidth Billing

[Bill Nash]

On Wed, 2 May 2007, Roland Dobbins wrote:

> 
> > Ghetto intrustion detection
> 
> One can do full-blown statistical and/or behavioral anomaly-detection  
> with NetFlow, it's used quite widely for this application.

Oh, I completely agree with you. I use the term 'ghetto' because it's not 
as precise as say, a packet inspection solution, and it can be implemented 
simply (speaking to the scale of the original poster's network). Both have 
their strengths and weakness and can complement each other fantastically, 
used correctly.

- billn