[ale] Etherreal and switches

[cobalt D&T]

On 9/28/06, Jim Popovitch <jimpop at yahoo.com> wrote:
>
> On Thu, 2006-09-28 at 13:37 -0400, Christopher Fowler wrote:
> > On Thu, 2006-09-28 at 13:31 -0400, Michael Still wrote:
> > > Err.. SNMP won't work for this?
> >
> > I do not know.  Can SNMP tell me what % of pipe is used by HTTP traffic?
> > What % is SSH.
>
> You need netflow data for that.  I think that Cacti supports parsing of
> netflow.
>
> -Jim P.
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale
>

FYI,
Netflow does that quite well.
But, there are couple of things to think about.
First, it is usually used to sample the pkts. So, you should carefully
choose the parameter of sample rate, inactive timeout, active timeout etc
for the accuracy of the analysis.
Second, you can choose the sample rate of 1/1 to collect all flows, but
it can eat up cpu of the routers very easily which will affect the
performance of the router deadly escpeciall cisco's. Juniper's or ECI's
(laurel's) might be better.

/AJ
-------------- next part --------------
An HTML attachment was scrubbed...