-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Kieran,
- --On March 1, 2007 11:13:44 -0700 Kieran Rhysling <[EMAIL PROTECTED]> wrote:
|
| I have a setup where a load balancer is sending sessions to multiple
| devices that produce netflows. Each device is seeing unique traffic.
|
| I was planning to have each device send to a separate nfcapd process
| listening on a different port on a single collector box. However, that
| makes searching through flows more of a hassle.
|
| Are there any potential problems with having each device send to the
| same nfcapd process, listening on one port. It would basically be
| recombining what the load balancer split up.
|
| I can't see any problems but wanted some feedback before I implement it
| this way. I'd hate to find out later it caused me to lose flows somehow.
This should work, if you think of these points:
- - You can no longer separate the two stream, once they hit the collector.
- - The collector will report a lot of sequence errors, as both streams will
disturb each others flow sequence. This has no further consequences unless
entries
in the log files and the sequence error info in the flow header in each file.
- - If you export v9, make sure each exporter has a unique ID or they must at
least
export exactly the same flow templates, otherwise data is decodes as
completely
rubbish.
Future versions of the collector will be able to separate streams.
- Peter
|
| Thanks,
| Kieran
|
|
| -------------------------------------------------------------------------
| Take Surveys. Earn Cash. Influence the Future of IT
| Join SourceForge.net's Techsay panel and you'll get the chance to share your
| opinions on IT & business topics through brief surveys-and earn cash
| http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
| _______________________________________________
| Nfdump-discuss mailing list
| Nfdump-discuss@lists.sourceforge.net
| https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Limmatquai 138, CH-8001 Zurich, Switzerland
E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
iQCVAwUBRefb7v5AbZRALNr/AQLUCgP+N1q9pspkm4pbv8YYJG8Gatfu/Rsz3to8
RGU2KHTFkkjibXLHe3LMYD+c0QFkMoo1frP5EhCR3oxgUnB4VvcVR3uZVoPlcfit
6Vx0swYY11PIyXKhlQ/taFzwv8LRCrmbpsUZhEbmOPgOqZmmz72adFVcmgdmkpZv
4JjXDwEZ0kc=
=NvPx
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Nfdump-discuss mailing list
Nfdump-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
