On Jan 12, 2008, at 10:25 AM, Tony Li wrote:
> This is correct. What do you do with the data? Without dedicated
> high bandwidth storage, there's no place for it to go.
6500 and 7600 have SPAN/RSPAN and copy/capture VACLs which merely
replicate the traffic, the collection system has to be directly
attached. There's also ERSPAN on Sup720 which can encapsulate the
sniffed traffic in GRE and ship out out layer-3, but one must be
careful to avoid the hall-of-mirrors effect (i.e., send it over the
DCN).
Flexible NetFlow, currently available in software-based routers
running T-train, allows one to grab header and/or payload data, and
then export it in NetFlow v9 format. I'm given to understand that the
major NetFlow analysis vendors are working to add support (no word yet
on open source tool support; anything which is v9-capable can collect
the flows, but then the tool must be able to interpret/sort on the
telemetry).
-----------------------------------------------------------------------
Roland Dobbins <[EMAIL PROTECTED]> // 408.527.6376 voice
Culture eats strategy for breakfast.
-- Ford Motor Company
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
