Huff,
Flow-capture doesnt seem having a machanism to split netflow data into multiple files. You may consider following options:
1. use port to differentiate them, each port mapping to one flow stream.
2. dump into one file first, use flow-filter etc to split into multiple files to fit your use.
But for the above two, you may have to run multiple applications that consume flow data.
3. depends on your application, if it has the intelligence, you may dump in one file and rely on it to figure out. That's what we are doing now, very efficient.
Regards, Eric
Message: 1 Date: Fri, 22 Apr 2005 13:43:22 -0500 From: "Huff, David" <[EMAIL PROTECTED]> Subject: [Flow-tools] Simplest way to support flows from multiple routers To: <[email protected]> Message-ID: <[EMAIL PROTECTED]> Content-Type: text/plain; charset="us-ascii"
Pardon what's probably a pretty simple request from a newbie, I was wondering what the simplest way is to support multiple routers exporting flow data to one server. Looked through the mailing list archives but nothing just jumped out at me that's quite what I had in mind. Here's what we're after:
When using Cisco's NFCollector, multiple routers export data to the same port on the server, and nfcollector just seems to "handle it," writing daily data for each into a separate subdirectory of the /opt/CSCOnfc/Data tree based on the router's IP addr. What's the easiest way to get flow-tools to do the same ?
My guess was to have multiple instances of flow-capture running, each with a different "-w" path and with "0/routerip/9995" But I was wondering if the different instances of flow-capture could handle all the data coming in on the one port (9995) and be able to sort things out w/o problems. Are there more elegant ways to do this ? If I have just one flow-capture running with "0/0/9995" so it dumps all the flows into on data file, could I use the other flow-tools to tease out the data from the individual routers later ?
Thanks,
--
_ __| |_ David P. Huff, Texas Instruments, Inc.
\_ _} Network Management Services
\_( [EMAIL PROTECTED], (214) 567-1882
------------------------------
_______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
