[c-nsp] NetFlow Vs. SPAN (mix?) for detecting less than savory application behavior.

[Roland Dobbins]

On Feb 5, 2008, at 9:17 PM, Drew Weaver wrote:

> I would welcome suggestions on whether NetFlow Vs. SPAN (possibly  
> using some SNORT implementation at the aggregation points would  
> allow us to detect some of the more obvious annoyances) would be the  
> best course of action or if possibly a combination of both would be  
> the best any advice from folks who have already automated detection  
> of things of this sort would be great as well.

<http://homepage.mac.com/roland.dobbins/FileSharing5.html>

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at cisco.com> // 408.527.6376 voice

	Culture eats strategy for breakfast.

            -- Ford Motor Company