Isn't SNMP better suited for link rate calculation? Also it takes less
processing power and less network traffic to achieve what you want. Check
out Cacti or MRTG...
On Tue, Mar 4, 2008 at 1:39 PM, Peter Haag <[EMAIL PROTECTED]> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
>
> - --On March 4, 2008 16:15:17 +0530 Venu Gopal <[EMAIL PROTECTED]> wrote:
>
> | Hi Peter,
> |
> | Thanks for the reply.
> |
> | I am not arguing about later-2 info in netflow implementation.
> | What I mean to say is there can be an option where a user can
> | add layer-2 header details which can be considered to compute
> | data rate.
> |
> | At present we need to calculate it manually considering
> | the total no. of packets and adding (L2 header*no.of packets).
> | This helps especially when computing the bandwidth usage over
> | WAN.
>
> Oh - I see now what you mean. Yes - I guess you need to do that manually,
> or implement something specific for your needs.
> Keep us informed.
>
> - Peter
> |
> | About your guess...you got it right !
> | Temporarily we have created shadow profiles to monitor specific class
> | of traffic.
> |
> | Venu
> |
> | On Tue, Mar 4, 2008 at 3:57 PM, Peter Haag <[EMAIL PROTECTED]> wrote:
> |
> | > -----BEGIN PGP SIGNED MESSAGE-----
> | > Hash: SHA1
> | >
> | >
> | >
> | > - --On March 4, 2008 14:09:55 +0530 Venu Gopal <[EMAIL PROTECTED]>
> wrote:
> | >
> | > | Thats OK Peter !
> | > | I'm trying to tweak the nfdump to do this.
> | > | I'll let you know once its done.
> | > |
> | > | We have been using ndump+nfsen for quite sometime and found it very
> | > useful.
> | > | We have some requests and ideas if you like.
> | > | It is possible to have option to add layer-2 headers (fixed) for
> data
> | > rate
> | > | calculation.
> | > | They may include HDLC/Cisco-HDLC encapsulations over WAN.
> | >
> | > well - nfdump in the next version will include many more v9 tags.
> However,
> | > as not even the CISCO boxes have adequate
> | > implementation of v9 I doubt that layer 2 header will be a point a
> near
> | > future.
> | >
> | > nfdump will also include a command line real time monitor, but with
> | > instant data, but most likely without the top n stat
> | > options ( not yet decided ) a kind of tcpdump for incoming netflow
> data.
> | > But I guess this is not what you need here.
> | >
> | > - Peter
> | >
> | >
> | > |
> | > | Venu
> | > |
> | > | On Tue, Mar 4, 2008 at 1:58 PM, Peter Haag <[EMAIL PROTECTED]>
> wrote:
> | > |
> | > | > -----BEGIN PGP SIGNED MESSAGE-----
> | > | > Hash: SHA1
> | > | >
> | > | >
> | > | >
> | > | > - --On March 4, 2008 13:38:22 +0530 Venu Gopal <[EMAIL PROTECTED]
> >
> | > wrote:
> | > | >
> | > | > | Hi Peter,
> | > | > |
> | > | > | I do understand your point.
> | > | > | But as an administrator we may use various filters online
> | > | > | just like tcpdump. Instead of creating profiles in prior it
> would be
> | > | > | useful if we can have this feature online.
> | > | >
> | > | > So use shadow profiles! They only create the graphs, and do not
> use
> | > disk
> | > | > space for flows.
> | > | > There are currently no other plans.
> | > | >
> | > | > - Peter
> | > | >
> | > | > |
> | > | > | Venu
> | > | > |
> | > | > | On Tue, Mar 4, 2008 at 12:43 PM, Peter Haag <
> [EMAIL PROTECTED]>
> | > | > wrote:
> | > | > |
> | > | > | > -----BEGIN PGP SIGNED MESSAGE-----
> | > | > | > Hash: SHA1
> | > | > | >
> | > | > | >
> | > | > | >
> | > | > | > - --On March 4, 2008 9:59:48 +0530 venu gopal <
> [EMAIL PROTECTED]>
> | > | > wrote:
> | > | > | >
> | > | > | > | Hi,
> | > | > | > |
> | > | > | > | Nfsen shows the following statistics graphically
> | > | > | > | 1. Packets
> | > | > | > | 2. Traffic
> | > | > | > | 3. Flows
> | > | > | > |
> | > | > | > | Is it possible to show these statistics for the filtered
> traffic
> | > | > | > | with out creating the specific profiles ?
> | > | > | >
> | > | > | > You'll have all these graphs with profiles.
> | > | > | > Filtered traffic are profiles - so what's wrong with profiles?
> | > | > | >
> | > | > | > - Peter
> | > | > | >
> | > | > | > |
> | > | > | > | Venu
> | > | > | >
> | > | > | >
> | > | > | >
> | > | > | > - --
> | > | > | > _______ SWITCH - The Swiss Education and Research Network
> ______
> | > | > | > Peter Haag, Security Engineer, Member of SWITCH CERT
> | > | > | > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D
> D7
> | > | > | > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich,
> Switzerland
> | > | > | > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
> | > | > | > -----BEGIN PGP SIGNATURE-----
> | > | > | > Version: GnuPG v1.4.3 (Darwin)
> | > | > | >
> | > | > | >
> iQCVAwUBR8z2nf5AbZRALNr/AQLfpAP/TfIJ7+Wm9diIlG3dR/smDzPTL/fCSRy8
> | > | > | >
> gsud5ST5C8hUjgfbXdNqLbH4eaUIG9PUOdWlqbwtvOfpmblis7ySc1FCn0hNlKxV
> | > | > | >
> uBVseGx39naKLIvPNQOtJRYwRFHt+6PPXMbyiNZxb1h1eHbEuYxCZNu1apRKejer
> | > | > | > 0McgXcQFK4o=
> | > | > | > =ZsmD
> | > | > | > -----END PGP SIGNATURE-----
> | > | > | >
> | > | > | >
> | > | >
> | > | >
> | > | >
> | > | > - --
> | > | > _______ SWITCH - The Swiss Education and Research Network ______
> | > | > Peter Haag, Security Engineer, Member of SWITCH CERT
> | > | > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
> | > | > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
> | > | > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
> | > | > -----BEGIN PGP SIGNATURE-----
> | > | > Version: GnuPG v1.4.3 (Darwin)
> | > | >
> | > | > iQCVAwUBR80IRv5AbZRALNr/AQIGdwP/fZf78cGOoeEQYvnBZIMR0VRp8pqwZzdk
> | > | > e2zWMFmM+BrfASAXzfEZ+zZggXLjOskuWsDEhLuFa8An4yZHrSOvTSbmx2akTZtD
> | > | > XHMajL6QyO8ciNw2YwcZ4AX6EMdlNpUSR1C2gxL4GPyxp16Z1/NRIu5KpA8pMmUD
> | > | > /wTr5h6IawY=
> | > | > =agDD
> | > | > -----END PGP SIGNATURE-----
> | > | >
> | > | >
> | >
> | >
> | >
> | > - --
> | > _______ SWITCH - The Swiss Education and Research Network ______
> | > Peter Haag, Security Engineer, Member of SWITCH CERT
> | > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
> | > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
> | > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
> | > -----BEGIN PGP SIGNATURE-----
> | > Version: GnuPG v1.4.3 (Darwin)
> | >
> | > iQCVAwUBR80kLv5AbZRALNr/AQLeawQAo2H6ltFsaDkybIj5MJht64ru9ykVCS8E
> | > ChEV0Bah3AMFlGBzvUkgAVe8BWa5ivkxEHCQnABxzCxNr0qNJKgX53pt7u4rmuss
> | > z9w5BNGtl44YxAOWv2LtZ4t2Itx19UtN6Ra59jbREepq6X6LrJW+42XFESyMvK5A
> | > jWJ5wrT48/8=
> | > =yhT6
> | > -----END PGP SIGNATURE-----
> | >
> | >
>
>
>
> - --
> _______ SWITCH - The Swiss Education and Research Network ______
> Peter Haag, Security Engineer, Member of SWITCH CERT
> PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
> SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
> E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.3 (Darwin)
>
> iQCVAwUBR8005P5AbZRALNr/AQIOPwQAg+hEjHERCwDyJg2JXxLJqkbU67cz8gIm
> rYMSEfvBY7fy/iBurWNUFxJKx3km1qqzCemR4oqX0NOQ42ekLee5bv+XVd8EsMWn
> gr0xQlzSI2vvXXPjY1eEnlcqZd+oTJYo2sZSCxq1P11MBFWAKDVAqW/1C2FCF58g
> zgvulgjxSVs=
> =5Dws
> -----END PGP SIGNATURE-----
>
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Nfsen-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
>
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
