-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --On March 4, 2008 16:15:17 +0530 Venu Gopal <[EMAIL PROTECTED]> wrote:
| Hi Peter,
|
| Thanks for the reply.
|
| I am not arguing about later-2 info in netflow implementation.
| What I mean to say is there can be an option where a user can
| add layer-2 header details which can be considered to compute
| data rate.
|
| At present we need to calculate it manually considering
| the total no. of packets and adding (L2 header*no.of packets).
| This helps especially when computing the bandwidth usage over
| WAN.
Oh - I see now what you mean. Yes - I guess you need to do that manually,
or implement something specific for your needs.
Keep us informed.
- Peter
|
| About your guess...you got it right !
| Temporarily we have created shadow profiles to monitor specific class
| of traffic.
|
| Venu
|
| On Tue, Mar 4, 2008 at 3:57 PM, Peter Haag <[EMAIL PROTECTED]> wrote:
|
| > -----BEGIN PGP SIGNED MESSAGE-----
| > Hash: SHA1
| >
| >
| >
| > - --On March 4, 2008 14:09:55 +0530 Venu Gopal <[EMAIL PROTECTED]> wrote:
| >
| > | Thats OK Peter !
| > | I'm trying to tweak the nfdump to do this.
| > | I'll let you know once its done.
| > |
| > | We have been using ndump+nfsen for quite sometime and found it very
| > useful.
| > | We have some requests and ideas if you like.
| > | It is possible to have option to add layer-2 headers (fixed) for data
| > rate
| > | calculation.
| > | They may include HDLC/Cisco-HDLC encapsulations over WAN.
| >
| > well - nfdump in the next version will include many more v9 tags. However,
| > as not even the CISCO boxes have adequate
| > implementation of v9 I doubt that layer 2 header will be a point a near
| > future.
| >
| > nfdump will also include a command line real time monitor, but with
| > instant data, but most likely without the top n stat
| > options ( not yet decided ) a kind of tcpdump for incoming netflow data.
| > But I guess this is not what you need here.
| >
| > - Peter
| >
| >
| > |
| > | Venu
| > |
| > | On Tue, Mar 4, 2008 at 1:58 PM, Peter Haag <[EMAIL PROTECTED]> wrote:
| > |
| > | > -----BEGIN PGP SIGNED MESSAGE-----
| > | > Hash: SHA1
| > | >
| > | >
| > | >
| > | > - --On March 4, 2008 13:38:22 +0530 Venu Gopal <[EMAIL PROTECTED]>
| > wrote:
| > | >
| > | > | Hi Peter,
| > | > |
| > | > | I do understand your point.
| > | > | But as an administrator we may use various filters online
| > | > | just like tcpdump. Instead of creating profiles in prior it would be
| > | > | useful if we can have this feature online.
| > | >
| > | > So use shadow profiles! They only create the graphs, and do not use
| > disk
| > | > space for flows.
| > | > There are currently no other plans.
| > | >
| > | > - Peter
| > | >
| > | > |
| > | > | Venu
| > | > |
| > | > | On Tue, Mar 4, 2008 at 12:43 PM, Peter Haag <[EMAIL PROTECTED]>
| > | > wrote:
| > | > |
| > | > | > -----BEGIN PGP SIGNED MESSAGE-----
| > | > | > Hash: SHA1
| > | > | >
| > | > | >
| > | > | >
| > | > | > - --On March 4, 2008 9:59:48 +0530 venu gopal <[EMAIL PROTECTED]>
| > | > wrote:
| > | > | >
| > | > | > | Hi,
| > | > | > |
| > | > | > | Nfsen shows the following statistics graphically
| > | > | > | 1. Packets
| > | > | > | 2. Traffic
| > | > | > | 3. Flows
| > | > | > |
| > | > | > | Is it possible to show these statistics for the filtered traffic
| > | > | > | with out creating the specific profiles ?
| > | > | >
| > | > | > You'll have all these graphs with profiles.
| > | > | > Filtered traffic are profiles - so what's wrong with profiles?
| > | > | >
| > | > | > - Peter
| > | > | >
| > | > | > |
| > | > | > | Venu
| > | > | >
| > | > | >
| > | > | >
| > | > | > - --
| > | > | > _______ SWITCH - The Swiss Education and Research Network ______
| > | > | > Peter Haag, Security Engineer, Member of SWITCH CERT
| > | > | > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
| > | > | > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
| > | > | > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
| > | > | > -----BEGIN PGP SIGNATURE-----
| > | > | > Version: GnuPG v1.4.3 (Darwin)
| > | > | >
| > | > | > iQCVAwUBR8z2nf5AbZRALNr/AQLfpAP/TfIJ7+Wm9diIlG3dR/smDzPTL/fCSRy8
| > | > | > gsud5ST5C8hUjgfbXdNqLbH4eaUIG9PUOdWlqbwtvOfpmblis7ySc1FCn0hNlKxV
| > | > | > uBVseGx39naKLIvPNQOtJRYwRFHt+6PPXMbyiNZxb1h1eHbEuYxCZNu1apRKejer
| > | > | > 0McgXcQFK4o=
| > | > | > =ZsmD
| > | > | > -----END PGP SIGNATURE-----
| > | > | >
| > | > | >
| > | >
| > | >
| > | >
| > | > - --
| > | > _______ SWITCH - The Swiss Education and Research Network ______
| > | > Peter Haag, Security Engineer, Member of SWITCH CERT
| > | > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
| > | > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
| > | > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
| > | > -----BEGIN PGP SIGNATURE-----
| > | > Version: GnuPG v1.4.3 (Darwin)
| > | >
| > | > iQCVAwUBR80IRv5AbZRALNr/AQIGdwP/fZf78cGOoeEQYvnBZIMR0VRp8pqwZzdk
| > | > e2zWMFmM+BrfASAXzfEZ+zZggXLjOskuWsDEhLuFa8An4yZHrSOvTSbmx2akTZtD
| > | > XHMajL6QyO8ciNw2YwcZ4AX6EMdlNpUSR1C2gxL4GPyxp16Z1/NRIu5KpA8pMmUD
| > | > /wTr5h6IawY=
| > | > =agDD
| > | > -----END PGP SIGNATURE-----
| > | >
| > | >
| >
| >
| >
| > - --
| > _______ SWITCH - The Swiss Education and Research Network ______
| > Peter Haag, Security Engineer, Member of SWITCH CERT
| > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
| > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
| > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
| > -----BEGIN PGP SIGNATURE-----
| > Version: GnuPG v1.4.3 (Darwin)
| >
| > iQCVAwUBR80kLv5AbZRALNr/AQLeawQAo2H6ltFsaDkybIj5MJht64ru9ykVCS8E
| > ChEV0Bah3AMFlGBzvUkgAVe8BWa5ivkxEHCQnABxzCxNr0qNJKgX53pt7u4rmuss
| > z9w5BNGtl44YxAOWv2LtZ4t2Itx19UtN6Ra59jbREepq6X6LrJW+42XFESyMvK5A
| > jWJ5wrT48/8=
| > =yhT6
| > -----END PGP SIGNATURE-----
| >
| >
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
iQCVAwUBR8005P5AbZRALNr/AQIOPwQAg+hEjHERCwDyJg2JXxLJqkbU67cz8gIm
rYMSEfvBY7fy/iBurWNUFxJKx3km1qqzCemR4oqX0NOQ42ekLee5bv+XVd8EsMWn
gr0xQlzSI2vvXXPjY1eEnlcqZd+oTJYo2sZSCxq1P11MBFWAKDVAqW/1C2FCF58g
zgvulgjxSVs=
=5Dws
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
