[c-nsp] NetFlow for Bandwidth Billing

Bill Nash billn at billn.net
Wed May 2 12:52:45 EDT 2007


On Wed, 2 May 2007, Roland Dobbins wrote:

> 
> > Ghetto intrustion detection
> 
> One can do full-blown statistical and/or behavioral anomaly-detection  
> with NetFlow, it's used quite widely for this application.

Oh, I completely agree with you. I use the term 'ghetto' because it's not 
as precise as say, a packet inspection solution, and it can be implemented 
simply (speaking to the scale of the original poster's network). Both have 
their strengths and weakness and can complement each other fantastically, 
used correctly.

- billn


More information about the cisco-nsp mailing list