[j-nsp] Same netflow data to same collector but different ports

[Mark Meijerink]

Emmanuel,

We use the Unix tool samplicator at our Netflow collector to symplicate the Netflow packet to multiple UDP ports. Multiple collectors listening to different ports. This might work for you as well.


Regards,
 Mark

 

-----Original Message-----
From: juniper-nsp-bounces at puck.nether.net [mailto:juniper-nsp-bounces at puck.nether.net] On Behalf Of Emmanuel Halbwachs
Sent: Tuesday, August 09, 2011 7:15 PM
To: juniper-nsp at puck.nether.net
Subject: [j-nsp] Same netflow data to same collector but different ports

Hello,

I would like to run more than one collector software on the same
host. The use case is:

- benchmarking different tools with the same netflow data
- running simultaneously two tools with complementary features

The idea was to send the same netflow data to different UDP ports, but
on our MX80 (10.4R3.4), it seems that only one 'port' stanza is
permitted per 'flow-server' container.

[edit forwarding-options sampling family inet output]
flow-server 10.0.0.20 {
    port [ 2055 2056 2057 ];  <-- NOT POSSIBLE
}

Using one IP per software and using IP alias on the collector host
works but is, well, not that elegant and not that convenient:

set forwarding-options sampling family inet output flow-server 10.0.0.20 port 2055
set forwarding-options sampling family inet output flow-server 10.0.0.21 port 2056
set forwarding-options sampling family inet output flow-server 10.0.0.22 port 2057

If someone have some clues.

Thanks,

-- 
Emmanuel Halbwachs                       Observatoire de Paris-Meudon
Resp. Réseau/Sécurité                           5 Place Jules Janssen
tel  :  +33 1 45 07 75 54                        F 92195 MEUDON CEDEX
fax  :  +33 1 45 07 01 89      véhicules : 11 av. Marcellin Berthelot
_______________________________________________
juniper-nsp mailing list juniper-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/juniper-nsp