[j-nsp] Cflowd question.

[Mark Fullmer]

There are a bunch of different ways to do this.

  FlowScan - , http://net.doit.wisc.edu/~plonka/FlowScan/,
  Stager - http://software.uninett.no/stager/
  FlowViewer/FlowGrapher - http://ensight.eos.nasa.gov/FlowViewer/

And probably more I haven't kept up with NetFlow development lately.

You can also run a report directly with flow-tools.

In flow-nfilter:

  o define the customer with an ip-address-prefix filter

  o define the interface of the customer with an if-index filter.

  o define the interface of the transit with an if-index filter.

In flow-report:

  Create a report that references the above filters.

Run each 5 minute flow file through the report.

Use flow-report2rrd to make pictures.

If you have many customers then look into flow-tag which allows 
associating a 32 bit tag with a prefix list which can later be
filtered, masked, or used for a report key.

See - ftp://ftp.eng.oar.net/pub/flow-tools/training/NetFlowSummit.ppt
for some examples of using flow-nfilter, flow-report, and flow-report2rrd
together.

--
mark


On Mon, Jul 10, 2006 at 11:24:40AM +0200, Dennis Ponne wrote:
> Hi All,
> 
> After a while searching for flow tools, I discoverd the package flowtools en 
> cflowd tools, installed it and got it up and running, no I have stats 
> concerning our network from AS number to AS number, wich protocols are being 
> used, and how much traffic they use.
> 
> Now I want to see something else and I can't seem to find the specific 
> software for this.
> 
> I want meassure traffic from a customer subnet (like 192.168.0.1/24) towards 
> other interfaces, so for example:
> 
> Customer subnet sends traffic towards transit 1, transit 2, and exchange 
> point 1.
> 
> Then I want to know based on percentile how much traffic the subnet does 
> towards these interfaces.
> 
> Does anyone has the software to do this, or a configuration example for this 
> with flow tools, it seems impossible for me to find correct and good working 
> software.
> 
> Thanks for your help,
> 
> Dennis Ponne
> MuntInternet 
> 
> _______________________________________________
> juniper-nsp mailing list juniper-nsp at puck.nether.net
> http://puck.nether.net/mailman/listinfo/juniper-nsp