> > Hi, > A very simple method to avoid duplicate flow is, if possible, > to activate netflow of all the inbound interface of your > network and not on the outgoing interface (functionnality > available on some routers) > > By doing so every flow will be count only once and every flow > will be "seen".
Thanks for the suggestion - Our routers are doing "one armed routing", so interfaces perform both in+out duties. > > Regards. > > > > -----Message d'origine----- > De : [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] De la part de > Michael Bellears Envoy� : samedi 14 mai 2005 03:55 � : Mike > Hunter Cc : [email protected] Objet : RE: > [Flow-tools] Multiple Cisco Routers > > Hi Mike, > > > > Just wondering what the is the best method to handle the seperate > > > exporters? (Separate flow-tools server for each, then > "combine" the > > > flows, or have them all exporting to the one flow-tools server?). > > > > > > The routers will be in geographically disperse locations. > > > > Since flow PDUs are UDP, we tend to try to put flow-collectors > > geographically near the routers, then ship the collected files to a > > processing box via a reliable transport (i.e. tcp.) At the > collector > > box, there's a /data/router_ directory for each router, and our > > analysis scripts do things like flow-cat /data/router*/*$date* to > > scoop up all the flow data; it's easier to recombine than > to sift out. > > What do you do with duplicate flows? > > Example: Traffic destined for client xxx.xxx.xxx.1 comes in > via Router B (Internet Feed), which is then routed to client > who is connected to Router A - Both Router A + Router B will > have a flow for this traffic, so there is a chance of double billing? > > As we have multiple upstream connections (All on different > routers), traffic destined for a given destination can > potentially come in via any of these Upstreams(Due to BGP) - > How do we ensure that we sift out these duplicates? > > Regards, > Michael > > > > > The flow-collectors themselves can be very modest servers; > > flow-capture doesn't take a lot of CPU, at least with the > routers we > > have. > > > > Mike > > > _______________________________________________ > Flow-tools mailing list > [EMAIL PROTECTED] > http://mailman.splintered.net/mailman/listinfo/flow-tools > _______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
