I have been reading the archives for a while now about collection hardware and collection clusters. A few threads I have found very informative for my research on a proposed collection architecture for my company:
http://mailman.splintered.net/pipermail/flow-tools/2004-October/002391.html and http://mailman.splintered.net/pipermail/flow-tools/2004-March/002004.html and the hardware survey posting as well. 1. With a multi-collector architecture, flow-capture is run on each collector and the routers in each POP are grouped together to export to a dedicated collector. Do the rest of the flow-tools programs get installed on these distributed collectors. So, does each collector then post-process the data using flow-report or flowscan. 2. Related to 1), in a description of the Abilene collection system, it seems like the flows are stored on 4 or so different collectors and then bulk copied periodically to a larger (primary) collector with massive storage. What is the purpose of this and would it be sufficient to keep the storage and post processing jobs distributed on each collector? Would it be possible to run the post-processing on each POP collector and then rsync the RRD directories to a central analysis server? 3. Our PE routers have MPLS tagging enabled which I think means that version 5 of netflow doesn't cache flows from those interfaces. So we are considering exporting netflow data from our customer aggregation routers. However, a single aggregation router (no sampling) generates 1.7 GB of compressed data per day. I suspect this is due to the fact that netflow caching is enabled on the ATM interface that has thousands of subscriber sub-interfaces. Does the presence of so many sub-interfaces increase the amount of netflow data generated? Much appreciated, ----------------------------------------------- Bob Crooks P.Eng. Engineer - Network Security SaskTel NOTICE: This confidential e-mail message is only for the intended recipient(s). If you are not the intended recipient, be advised that disclosing, copying, distributing, or any other use of this message, is strictly prohibited. In such case, please destroy this message and notify the sender. _______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
