[c-nsp] more net flow, which interfaces to monitor and in which direction?

[Joe Loiacono]

If you're using netflow v9 or flexible netflow there are some cautions 
about using 'egress' together with 'ingress'.

There are some very good write-ups on this. Google-fu: 'netflow egress 
monitoring'

Joe



From:   Scott Granados <scott at granados-llc.net>
To:     "cisco-nsp at puck.nether.net" <cisco-nsp at puck.nether.net>
Date:   05/21/2014 02:39 PM
Subject:        [c-nsp] more net flow,  which interfaces to monitor and in 
which direction?
Sent by:        "cisco-nsp" <cisco-nsp-bounces at puck.nether.net>



Hi,
First, thanks for all the great input on analyzers and their strong and 
weak points.  It looks like from the comments I’m going to give nfsen a 
shot.
                 My followup question concerns selection of interfaces and 
the direction to monitor.  While googling I find that almost all examples 
I find are sampling in the input direction only.  Also most of the 
examples out there seem to be quite simple and involve one interface or a 
few.  In the case where  you might have many interfaces geographically 
diverse facing transit providers and you might have non symmetric routing 
is there some sort of science to what you monitor and in what direction? 
Is there an advantage to monitoring input flows only and if so what do you 
do to measure output?  Any pointers on interface selection and 
configuration would be most appreciated.  I’ve been googling but haven’t 
found much more than sampling on single or a few interfaces in one 
direction.

Thanks
Scott



_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/