[c-nsp] more net flow, which interfaces to monitor and in which direction?

[daveb]

Scott,

For nfsen, set your router to export IN and OUT.

The 'live' profile will be all your aggregate traffic on one graph.

For more granularity build other profiles as needed.  So you might 
have a profile for traffic IN and OUT for transit provider A.  Build 
a profile with a Channel using (Sources:) of router X and/or router 
Y, and (Filter:) using appropriate SNMP ifIndex (in IF 560 and out IF 
866), for inbound for example.  Then add another Channel to the same 
profile with IF's reversed for outbound traffic to be graphed as a 
separate colored area/line on the same graph.

That's assuming a fairly simple/small number of interfaces and 
directions. Not fun if you have a lot of changes but it works pretty 
well in a stable network.

Dave B.

At 02:31 PM 5/21/2014, you wrote:
>Hi,
>First, thanks for all the great input on analyzers and their strong 
>and weak points.  It looks like from the comments I'm going to give 
>nfsen a shot.
>         My followup question concerns selection of interfaces and 
> the direction to monitor.  While googling I find that almost all 
> examples I find are sampling in the input direction only.  Also 
> most of the examples out there seem to be quite simple and involve 
> one interface or a few.  In the case where  you might have many 
> interfaces geographically diverse facing transit providers and you 
> might have non symmetric routing is there some sort of science to 
> what you monitor and in what direction?  Is there an advantage to 
> monitoring input flows only and if so what do you do to measure 
> output?  Any pointers on interface selection and configuration 
> would be most appreciated.  I've been googling but haven't found 
> much more than sampling on single or a few interfaces in one direction.
>
>Thanks
>Scott
>
>
>
>_______________________________________________
>cisco-nsp mailing list  cisco-nsp at puck.nether.net
>https://puck.nether.net/mailman/listinfo/cisco-nsp
>archive at http://puck.nether.net/pipermail/cisco-nsp/