Hi, A very simple method to avoid duplicate flow is, if possible, to activate netflow of all the inbound interface of your network and not on the outgoing interface (functionnality available on some routers)
By doing so every flow will be count only once and every flow will be "seen". Regards. -----Message d'origine----- De : [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] De la part de Michael Bellears Envoyé : samedi 14 mai 2005 03:55 À : Mike Hunter Cc : [email protected] Objet : RE: [Flow-tools] Multiple Cisco Routers Hi Mike, > > Just wondering what the is the best method to handle the seperate > > exporters? (Separate flow-tools server for each, then "combine" the > > flows, or have them all exporting to the one flow-tools server?). > > > > The routers will be in geographically disperse locations. > > Since flow PDUs are UDP, we tend to try to put > flow-collectors geographically near the routers, then ship > the collected files to a processing box via a reliable > transport (i.e. tcp.) At the collector box, there's a > /data/router_ directory for each router, and our analysis > scripts do things like flow-cat /data/router*/*$date* to > scoop up all the flow data; it's easier to recombine than to sift out. What do you do with duplicate flows? Example: Traffic destined for client xxx.xxx.xxx.1 comes in via Router B (Internet Feed), which is then routed to client who is connected to Router A - Both Router A + Router B will have a flow for this traffic, so there is a chance of double billing? As we have multiple upstream connections (All on different routers), traffic destined for a given destination can potentially come in via any of these Upstreams(Due to BGP) - How do we ensure that we sift out these duplicates? Regards, Michael > > The flow-collectors themselves can be very modest servers; > flow-capture doesn't take a lot of CPU, at least with the > routers we have. > > Mike > _______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools _______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
