On Wed, Sep 08, 2004 at 11:13:18AM -0700, Julian Elischer wrote: J> >This is working solution, but not correct. :) J> >To catch both directions you should feed ng_netflow with incoming traffic J> >from all interfaces. J> > J> J> using 'tee' means you are duplicating all packets. J> shouldn't you do collection "inline? or does this NEED to have copies of J> the packets?
This is in my TODO and TOSEE list. I'm not yet sure that this would be better. There are some advantages in current state: packets are processed with no delay, and a copy is queued for netflow processing. In case of multiple interfaces attached to netflow node we can serve them simultaneosly, without waiting for lock on single netflow node. A good solution would be to send only IP and TCP header towards netflow node. Is there a standard way to do this? -- Totus tuus, Glebius. GLEBIUS-RIPN GLEB-RIPE _______________________________________________ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "[EMAIL PROTECTED]"
