On Thu, 11 Sep 2008, Phil Mayers wrote:
current ip flowmask for unicast: if-full
current ipv6 flowmask for unicast: null
Do you need the full mask? It includes tcp/udp ports. Dropping to
destination-source may save you a lot of flows (but obviously lose you a lot
of info)
I'd really like to keep ip-full. It's quite handy when tracking down what
an IP has been up to (like when trying to verify infection/scanning
complaints).
----------------------------------------------------------------------
Jon Lewis | I route
Senior Network Engineer | therefore you are
Atlantic Net |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
