We have been testing the FLUKE/CRANOG product and it appears to work very well and yes the GUI isn't the best but it has a lot of good features.
So since we are on the NETFLOW subject, what do other users see, as far as SWITCH CPU load when running when netflow is enabled? We are runnning it on a 720-3B with aprox 30 SVIs and aprox 150 L2 ports that are associated with the SVI vlans. As soon as I enable the MLS (hardware switched flows) portion of the netflow, the switch CPU jumps up to around 50-80. Since we want to collect all flows, we do not want to do sampled flows. With this kind of CPU load it does not seem practical to run netflow. We also ran into an issue where we had QOS enabled and were using User Based Rate Limiting UBRL with a SOURCE flowmask; But with this enabled there was a flowmask conflict with netflow trying to use a different flowmask "interface-full", so we could not use both. This was confirmed with CISCO. Has anybody else seen the CPU or flowmask issue? I thought this might be of interest to the group. Thanks for any input. Jeff Fitzwater OIT Network & Telecommunication s Systems Princeton University On Nov 20, 2007, at 7:24 AM, Dirk-Jan van Helmond wrote: > I'm using nfsen by Peter Haag and I'm very happy with it. > It's free. > > > > >> Hi, >> >> I need to use netflow to analyze traffic, does somebody have any idea >> of existing software, commercial and free? >> >> Best regards. >> >> _______________________________________________ >> cisco-nsp mailing list [email protected] >> https://puck.nether.net/mailman/listinfo/cisco-nsp >> archive at http://puck.nether.net/pipermail/cisco-nsp/ >> > > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
