[c-nsp] more net flow, which interfaces to monitor and in which direction?

[Roland Dobbins]

On May 22, 2014, at 8:42 AM, Charles Sprickman <spork at bway.net> wrote:

> Complicated in that we have hundreds of interfaces.

Script it as part of your provisioning process, it's done.

>  Unwise in that my gut tells me enabling it on hundreds of subscriber interfaces is going to exhaust some resource that I’m not aware of.

In this case, your gut is being overly cautious.

;>

>  That’s probably just paranoia, but without knowing the inner workings of the platform I can’t really say.

I can.  It isn't a concern.

;>

> That’s just it - it’s not “routers”, but a single router with two transit connections and a bunch of subs.  I’m only concerned with looking at traffic to/from the internet, not any inter-subscriber traffic.

Actually, you should be very concerned with inter-subscriber traffic, from both a traffic engineering/capacity planning perspective as well as a security perspective.

----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

                   Equo ne credite, Teucri.

    		   	  -- Laocoön