The most detail will always come from seeing the real packets, so a SPAN port will always yield the most detail. Yes, SPAN the router(s) interface and you'll see everything the router sees. Also check into RSPAN so you won't need an "analyzer" - nTop / whatever everywhere. If your LAN has plenty of bandwidth available and you're monitoring WAN links, RSPAN is the way to go.
While SPAN will give the MOST detail, most often netflow is more than adequate. Again, depends on what you're wanting to do. I mainly want to see who is using all my bandwidth and what application they're using - and netflow does that well. Gary >>> [EMAIL PROTECTED] 9/28/2006 11:50 AM >>> On 9/28/06, Gary Gatten <[EMAIL PROTECTED]> wrote: > Netflow works pretty good for me. If you have core routers you can > enable it there - don't have to enable it on every remote. If you > choose to however, it will work. the netflow streams are routable so > the flow receiver(s) can be anywhere. You won't get as much detail as > you would capturing real packets, but fi you don't need that detail it's > far easier to configure all around - and WAY fewer resources. So if you want a lot of detail, do you plug it into a switch on the same network as the router and configure the router to send to it - or do you configure a SPAN port for the router's inside interface? _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop =========================================================================== "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
