Hi Giles,
There was an effort a while ago to integrate Holt Winters
prediction:
http://bakacsin.ki.iif.hu/~kissg/project/nfsen-hw/
Even a conference paper was born:
http://tnc2007.terena.org/programme/presentations/show.php?pres_id=93
Unfortunately the patch created by my colleague is incompatible with the
current nfsen release. Werner Shcram created a plugin for the new plugin
based nfsen implementation, but you cannot see the abberant behavior
detection by sight, however you can get IODEF reports.
http://www.surfnet.nl/publicaties/surfworks2006/indi-2006-11-046.pdf
http://www.mail-archive.com/[email protected]/msg00524.html
I believe there is a need for better integration of HW prediction in
nfsen, but currently nfsen author focusing on other improvements in nfsen.
Best Regards,
Janos Mohacsi
Network Engineer, Research Associate, Head of Network Planning and Projects
NIIF/HUNGARNET, HUNGARY
Key 70EF9882: DEC2 C685 1ED4 C95A 145F 4300 6F64 7B00 70EF 9882
On Tue, 11 Mar 2008, Giles Coochey wrote:
> I used to use Nfsen/Nfdump, but have since moved to using a commercial
> product.
>
> I'm now thinking about whether running Nfsen & Nfdump as well as the
> commercial product, mostly because I've been playing around with
> Holt-Winters prediction within RRDtool and Cacti and I would love to see
> this with my Netflow data, which can't be too difficult given that Nfsen
> uses RRDtool.
>
> I know how to input Holt-Winters RRAs into an RRD, after it has been
> created, but I'm wondering whether Nfsen/Nfdump has a built in option
> for this. Or whether it's in the roadmap so to speak.
>
> As, I'm sure, many use Nfsen for trend analysis and DDoS detection and
> alerting, I think this would be a great feature to be incorporated into
> the web interface.
>
> Obligatory link:
>
> http://www.usenix.org/events/lisa00/full_papers/brutlag/brutlag.pdf
>
> See page 144 for an example RRD graph.
>
> Regards,
>
> Giles
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Nfsen-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
>
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
