----- Original Message ---- From: Mark Prior <[EMAIL PROTECTED]> To: jay alvarez <[EMAIL PROTECTED]> Cc: flow tools <[email protected]> Sent: Wednesday, January 24, 2007 10:26:18 PM Subject: Re: [Flow-tools] In my case, should I choose peer-as or origin-as??
jay alvarez wrote: > > I'm only worried because I might be displaying erroneous reports, let's say > > I use flow-stat to report the top > > destination or source AS. > In that case you probably want origin-as. > Which version you choose depends on what data you want to mine and if > you want to know about the ultimate source or destination of the traffic > then you want origin-as. If you want to discover more about which > upstream is sending you the traffic then you want peer-as. So if I choose origin-AS then I will be able to create reports for top absolute destination AS and top absolute source AS, as well as graphs (CUGrapher.pl) because each netflow record will contain absolute source and destination ASNs, but if I specify peer-as, I can only generate top absolute destination AS reports but the top source ASN which will be recorded in its netflow record will always be either of those four peer AS/upstream providers where that particular traffic have passed through before it reaches our routers. Can anyone clear this for me.. And lastly, someone have suggested using experimental CampusIO extensions which can generate reports for both origin and peer as, I'll see if it fits our needs. Thanks... Mark. ____________________________________________________________________________________ Need Mail bonding? Go to the Yahoo! Mail Q&A for great tips from Yahoo! Answers users. http://answers.yahoo.com/dir/?link=list&sid=396546091 _______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
