-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Stuart,
- --On August 31, 2007 9:41:03 +0100 "Charles, Stuart" <[EMAIL PROTECTED]>
wrote:
|
| Changed to plain text format.....
|
| Hi
|
| I work for a Network provider and am currently investigating the
| feasibility of using NFSEN and customise it so that I can monitor our
| customer's network devices individually. I have got NFSEN set up and
| working on one exporter and I have to say I have been very impressed so
| far.
|
| To provide a separate NFSEN profile for each of our customers there
| would potentially be 10s or maybe evebn 100s of network devices exporter
| data to the NFSEN collector. I initially thought I could set up a filter
| on the network subnet (we have the network data stored for each customer
| in a separate database) so that I could filter all the data that comes
| into a single NFSEN listening port into separate profiles for each
| customer. However this will often mean that data will be double counted
| when the same traffic moves through more than one network device that is
| exporting netflows to the collector. Is there a way of filtering the
| data by exporter IP address or should each exporter send data to a
| different port?
|
| Thanks in advance for any help you can provide
This is not so easy at the moment. If you have netflow v5, there may be a
pragmatic
way: Feed everything into a single instance of nfcapd. Apart from the reported
sequence error in the log file, it has no impact. Thereafter create a profile
for
each customer, using the customer network IP as filter ( e.g. net 172.16.17/24 )
But you can no longer be tell apart the detailed exporters.
This will not work for v9 as each exporter may use the same template id but
different
template layout.
- Peter
|
| Regards
|
| Stuart
|
| ______________________________________________________________________
| This email has been scanned by the MessageLabs Email Security System.
| For more information please visit http://www.messagelabs.com/email
| ______________________________________________________________________
|
| -------------------------------------------------------------------------
| This SF.net email is sponsored by: Splunk Inc.
| Still grepping through log files to find problems? Stop.
| Now Search log events and configuration files using AJAX and a browser.
| Download your FREE copy of Splunk now >> http://get.splunk.com/
| _______________________________________________
| Nfsen-discuss mailing list
| [email protected]
| https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
iQCVAwUBRvefBf5AbZRALNr/AQKSgQP+OGA6/q4VaubE7MbO5bD2uhDuaKNaHwFZ
CSTkdHFvRAo5TbK8LrFjOt7k1echCYRsR9dydJyiTimSYFiTDjOEsUEq+OxYKwZS
toOEvVZsKtNHrxNw8+nv14MWhg735dPM77ByFbGZM5vPppRP8Hk4JP1lRlOWKY87
LrMn+KgYflc=
=Sms5
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
