Are the flows really identical? Even the numbers of packets and bytes. I now that some cisco routers (eg.6500) can produce 4 flows per tcp session. Because in these platforms the first packet in a flow is process differently then the rest of the packets resulting in two netflow records per flow. Where the first flow is always exactly one packet.
Daan 2011/11/22 Paul Stewart <[email protected]>: > When I process flows, it seems like there are often duplicates. If I > go to the command line and nfdump with option for detail, it confirms > this. I am using a single Cisco to source the data. My plan is to > capture some traffic to make sure the Cisco isn't duplicating it. I > was wondering if there are any common issues I should be looking for. > > ------------------------------------------------------------------------------ > All the data continuously generated in your IT infrastructure > contains a definitive record of customers, application performance, > security threats, fraudulent activity, and more. Splunk takes this > data and makes sense of it. IT sense. And common sense. > http://p.sf.net/sfu/splunk-novd2d > _______________________________________________ > Nfsen-discuss mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/nfsen-discuss ------------------------------------------------------------------------------ Cloud Services Checklist: Pricing and Packaging Optimization This white paper is intended to serve as a reference, checklist and point of discussion for anyone considering optimizing the pricing and packaging model of a cloud services business. Read Now! http://www.accelacomm.com/jaw/sfnl/114/51491232/ _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
