[c-nsp] Flow tools

[Jon Lewis]

On Wed, 18 Jan 2012, Dobbins, Roland wrote:

>
> On Jan 17, 2012, at 11:23 PM, John Brown wrote:
>
>> 6506-E Sup720-3BXL.
>
> The NetFlow you get from this box won't be operationally useful - many caveats.  Strongly suggest a move to Sup2T and DFC4 (where applicable), if you want good NetFlow from 6500s.

That really depends on his definition of "operationally useful".  At the 
traffic levels he mentioned, he'll likely have to do sampled netflow, but 
even that is useful for getting an idea of what's going on, identifying 
D?DoS targets/sources, verifying abusive traffic, etc.  Sampled netflow is 
certainly more operationally useful than no netflow.

----------------------------------------------------------------------
  Jon Lewis, MCP :)           |  I route
  Senior Network Engineer     |  therefore you are
  Atlantic Net                |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________