[f-nsp] Sflow and/or measurement

[Kristian Larsson]

On Sun, Nov 20, 2005 at 12:23:34AM +0100, Olivier Marc wrote:
> > If it doesn't *have* to be sflow, then there are
> > several free 
> > netflow-based solutions using port mirroring and a
> > unix box. I have had 
> > some success with FreeBSD and it's ng_netflow module
> > with flow-tools, 
> > for instance. I believe ntop can collect netflow
> > data too, as can nprobe.
> > 
> Thanks all for your answer (and sorry for my poor
> english :) )
> 
> But the mirroring solution, which consequence implies
> ? 
> Which is the limit ?
> 
> It would be necessary that this solution can support a
> network of 1,5Gbps...
Is that bidirectional?
PF_RING could perhaps be of assistance, but I'm
doubtful it will pull off 1,5Gbps.

1,5Gbps is a funny figure. is that perhaps 750Mbit
bidirectional traffic? or 1,5 on a 10gbps
interface?
if the latter you actually have 3gbps of traffic.
if the former you could perhaps split the job onto
two machines.

hardware wise I would recommend Opteron as they
have superior memory bandwidth compared to
anything else. Couple that with PCI-express based
networks cards and you will have no IO transaction
limits (you'll get wirespeed gigg).

  Kristian

> 
> 	
> 
> 	
> 		
> ___________________________________________________________________________ 
> Appel audio GRATUIT partout dans le monde avec le nouveau Yahoo! Messenger 
> Téléchargez cette version sur http://fr.messenger.yahoo.com
> _______________________________________________
> foundry-nsp mailing list
> foundry-nsp at puck.nether.net
> http://puck.nether.net/mailman/listinfo/foundry-nsp