Torch always shows both directions of single 'connection' in one line. NetFlow reports two flows, for each direction.
-- Подпись: (добавляется в конце всех исходящих писем) 2012/11/13 Scott Reed <[email protected]> > The issue may be that torch shows one address pair, not a line for dst/src > and another for src/dst. > The send and receive columns show the traffic going the respective > direction. > I have not done enough with netflow to know that it operates correctly. > > > On 11/13/2012 6:57 AM, Chupaka wrote: > >> "Now run torch on ether1 you get 1/2 the traffic" - ?.. Why?.. I see all >> the traffic in Torch %) >> >> -- >> Подпись: >> (добавляется в конце всех исходящих писем) >> >> >> >> 2012/11/13 <[email protected]> >> >> Does the Mikrotik traffic-flow / netflow correctly implement netflow? >>> >>> Reason I ask is there seems to be a disconnect between souce traffic and >>> destination traffic. For example if you have one interface that sees >>> _all_ >>> traffic it ether1 and ip is 10.5.5.5 the customer ip address is >>> 192.168.1.1 ether2 there is no nat on the router etc., it just a router. >>> Now run torch on ether1 you get 1/2 the traffic be it source or >>> destination 192.168.1.1. Run torch on ether2 be it source or destination >>> you get the other half of the traffic. netflow / traffic-flow and torch >>> will not report both sides of the conversation between 192.168.1.1 and >>> anything else. For every inbound response to a data query there is an >>> outbound response that should show on that interface because it is a <two >>> direction> conversation. >>> >>> It appears to me that Mikrotik netflow is not doing this correctly or it >>> is a bungled implementation. >>> >>> Thoughts? >>> >>> Jerry Allen >>> Vistabeam >>> >>> ______________________________**_________________ >>> Mikrotik mailing list >>> [email protected] >>> http://www.butchevans.com/**mailman/listinfo/mikrotik<http://www.butchevans.com/mailman/listinfo/mikrotik> >>> >>> Visit http://blog.butchevans.com/ for tutorials related to Mikrotik >>> RouterOS >>> >>> -------------- next part -------------- >> An HTML attachment was scrubbed... >> URL: <http://www.butchevans.com/**pipermail/mikrotik/** >> attachments/20121113/73e8fced/**attachment.html<http://www.butchevans.com/pipermail/mikrotik/attachments/20121113/73e8fced/attachment.html> >> > >> >> ______________________________**_________________ >> Mikrotik mailing list >> [email protected] >> http://www.butchevans.com/**mailman/listinfo/mikrotik<http://www.butchevans.com/mailman/listinfo/mikrotik> >> >> Visit http://blog.butchevans.com/ for tutorials related to Mikrotik >> RouterOS >> >> ----- >> No virus found in this message. >> Checked by AVG - www.avg.com >> Version: 2013.0.2793 / Virus Database: 2624/5883 - Release Date: 11/08/12 >> > > -- > Scott Reed > Owner > NewWays Networking, LLC > Wireless Networking > Network Design, Installation and Administration > > > Mikrotik Advanced Certified > www.nwwnet.net > (765) 855-1060 > (765) 439-4253 > (855) 231-6239 > > > > ______________________________**_________________ > Mikrotik mailing list > [email protected] > http://www.butchevans.com/**mailman/listinfo/mikrotik<http://www.butchevans.com/mailman/listinfo/mikrotik> > > Visit http://blog.butchevans.com/ for tutorials related to Mikrotik > RouterOS > -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://www.butchevans.com/pipermail/mikrotik/attachments/20121113/9f0e1888/attachment.html> _______________________________________________ Mikrotik mailing list [email protected] http://www.butchevans.com/mailman/listinfo/mikrotik Visit http://blog.butchevans.com/ for tutorials related to Mikrotik RouterOS
