On Apr 22, "Huff, David" wrote: > Pardon what's probably a pretty simple request from a newbie, I was > wondering what the simplest way is to support multiple routers exporting > flow data to one server. Looked through the mailing list archives but > nothing just jumped out at me that's quite what I had in mind. Here's > what we're after: > > When using Cisco's NFCollector, multiple routers export data to the same > port on the server, and nfcollector just seems to "handle it," writing > daily data for each into a separate subdirectory of the > /opt/CSCOnfc/Data tree based on the router's IP addr. What's the easiest > way to get flow-tools to do the same ? > > My guess was to have multiple instances of flow-capture running, each > with a different "-w" path and with "0/routerip/9995" But I was > wondering if the different instances of flow-capture could handle all > the data coming in on the one port (9995) and be able to sort things out > w/o problems. Are there more elegant ways to do this ? If I have just > one flow-capture running with "0/0/9995" so it dumps all the flows into > on data file, could I use the other flow-tools to tease out the data > from the individual routers later ?
We use a different instance of flow-capture for each router, with each instance running on a different port. So we end up with several directories like /data/router1, /data/router2, etc. It may seem like a bit of a hassle, but in the long run I think it's better to have the flows separate and be able combine them on demand rather than having to sort out after the fact. I'd recommend this approach unless you have a bunch of scripts that for some reason won't get along with this layout. I think flow-capture could accept flows from different routers on the same port, but I *don't* think it would "sort them out" for you; you'd have to look at each flow to see where it came from. Mike _______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
