[c-nsp] 'multiplexing" netflow?

[Mike Louis]

Have you tried this tool?

Flow Fan-out - It will replicate a single netflow source and send it out to multiple destinations.

http://www.splintered.net/sw/flow-tools/docs/flow-fanout.html

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Drew Weaver
Sent: Thursday, July 03, 2008 7:46 AM
To: 'Ben Hicks'; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] 'multiplexing" netflow?

Now I remember why I can't use this (sorry it's been a while since I've examined this)

The appliance we are sending our flows to can only handle maybe 1% of our actual flows (sampled) (and only from 2 out of 10 of our interfaces) I would like to send all of the flow data to another system for analysis.

So basically I would need to send all of the flow data to a middle-man, and then have it configured to somehow know what to send where.

-Drew
From: Ben Hicks [mailto:ben.hicks at centius.co.uk]
Sent: Thursday, July 03, 2008 7:22 AM
To: Drew Weaver; cisco-nsp at puck.nether.net
Subject: RE: [c-nsp] 'multiplexing" netflow?


Why not just have multiple export statements.

Taken from - http://www.cisco.com/en/US/docs/ios/12_0s/feature/guide/12s_mdnf.html#wp1021114



  export destination 10.0.101.254 9991
  export destination 10.0.101.254 1999



Many thanks,

Ben


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net on behalf of Drew Weaver
Sent: Thu 03/07/2008 12:18
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] 'multiplexing" netflow?

                Hi there, we have equipment at our edge that requires us to export our netflow to it in order for it to function but we would also like our NetFlow stats to be exported somewhere else for analysis.

Does anyone know of a product that you can export your netflow to that will then in turn export it to multiple destinations (that works well and is easy to use/reliable) ?

-Drew
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Note: This message and any attachments is intended solely for the use of the individual or entity to which it is addressed and may contain information that is non-public, proprietary, legally privileged, confidential, and/or exempt from disclosure.  If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strictly prohibited.  If you have received this communication in error, please notify the original sender immediately by telephone or return email and destroy or delete this message along with any attachments immediately.