Andrey is right. The bandwidth involved is very low, although a large number of collectors (or flows!) could eat a VERY large amount of disk space!
Exporting flows is not bandwidth intensive (it's basically just text), but it can be processor intensive on the routers (depending on the router, how many interfaces you are exporting flows on, and how much traffic/how many flows the router has to keep track of), which is one of the reasons the CAT3500 series won't do it. --- On a separate note, I'd like to see some discussion at least about pricing/licensing models. This is a handy feature, but because we are a wireless ISP, we have lots and lots of 'core routers', and the traffic is spread out everywhere, rather than coming into a few central routers/switches. Tim Huffman Director of Engineering Business Only Broadband, LLC O (630) 590-6012 C (630) 340-1925 [EMAIL PROTECTED] www.bobbroadband.com > -----Original Message----- > From: [email protected] [mailto:InterMapper- > [EMAIL PROTECTED] On Behalf Of Andrey Gordon > Sent: Friday, September 12, 2008 8:22 AM > To: InterMapper Discussion > Subject: Re: [IM-Talk] New InterMapper Feature - NetFlow Add-on - Call > forTesters > > I believe you maybe misunderstanding the way NetFlow works in general, not > in IM Flows in particular. > > The question whether Flows will work over WAN links is irrelevant, because > it's just IP packets. In other words, yes, it will work over WAN links. > > IM Flows is just another collector on your network of the NetFlow data > that > is being exported by NetFlow capable devices (in case of Cisco they are > mostly chassis based switches like 4500 and 6500, ISRs and MSRs.) For > example, any CAT3500 series won't export any NetFlow, even thought they > can > technically be configured as a router, they don't support NetFlow. > > In case of the last series of questions, I'll let dartware answer that if > they built in (thought of) supporting distributed collection and then > exporting it to the central server. Judging by the fact that there is no > such thing for InterMapper as NMS, I imagine that Flows have no reason to > support that either. > > On top of that, I was told that, for example a 500 device license will > include only two exporters (if I remember correclty), so I hope your > network > is designed with one or two core routers that all your traffic flows > through. > __________________________________________________________ > Andrey Gordon | Integrity Interactive | Network Engineer | +1.781.398.3518 > > > > > From: Manickaraja Arumugam <[EMAIL PROTECTED]> > > Reply-To: InterMapper Discussion <[email protected]> > > Date: Fri, 12 Sep 2008 17:14:30 +0530 > > To: InterMapper Discussion <[email protected]> > > Subject: RE: [IM-Talk] New InterMapper Feature - NetFlow Add-on - Call > > forTesters > > > > Hi Rich, > > > > Does this IM Flow will work on the WAN Links? > > How much bandwidth will consume? > > How frequent is the traffic will flow? > > > > The other way > > > > Does IM Flow will act as collector at the each location? > > After that the central Server can pull the data from each collector and > > co-relate the same? > > > > Regards > > Manicka Raja Arumugam > > A R I C E N T > > > > > > > > -----Original Message----- > > From: [email protected] > > [mailto:[EMAIL PROTECTED] On Behalf Of Richard E. > Brown > > Sent: Thursday, September 11, 2008 1:40 AM > > To: [email protected] > > Subject: [IM-Talk] New InterMapper Feature - NetFlow Add-on - Call > forTesters > > > > Folks: > > > > We are beginning a public test period for a new NetFlow Analysis > feature. This > > feature, called "InterMapper Flows", is an add-on to InterMapper that > will > > allow > > you to see what kinds of traffic are flowing on your network, as well as > which > > hosts are sending (or receiving) that traffic. > > > > One of our current testers had only been using InterMapper Flows for a > few > > hours > > when he detected unusual traffic from a virus-infected machine. He was > able to > > isolate and clean up the machine without a problem. > > > > NetFlow is a technique for traffic characterization. It is supported by > Cisco > > and certain other vendor's routers and switches, as well as software > tools > > such > > as nProbe, nTop, pfflowd, and others. These devices send ("export") > > information > > about the various flows of traffic through the network. InterMapper > Flows acts > > as a NetFlow "collector": it receives the flow records, saves them in a > > database, > > and then makes them available via an attractive user interface. > > > > InterMapper Flows is integrated directly into InterMapper's GUI. You can > > right-click > > on an exporter's icon to open a Flows Window, showing the traffic > flowing > > through > > it, or right click on any device icon to see that device's contribution > to the > > traffic. > > > > We would be delighted to have you try InterMapper Flows on your network. > Use > > the > > links at the bottom of this page to read more and to download the > software. If > > you have questions, you can send them to this list, or to > > [EMAIL PROTECTED] > > > > As always, we appreciate all the feedback you provide. Many thanks! > > > > Rich Brown > > Dartware, LLC > > > > ------------------------- > > > > Overview: > > http://dartware.com/support/tech_notes/imflows/index.html > > > > Watch the Video: > > http://dartware.com/downloads/viewvideo.html?file=imflows > > > > Download from: > > http://dartware.com/downloads/binaries/imflows.html > > > > Release Notes: > > http://dartware.com/downloads/binaries/imflowsreleasenotes.html > > ____________________________________________________________________ > > List archives: > > http://www.mail-archive.com/intermapper-talk%40list.dartware.com/ > > To unsubscribe: send email to: [EMAIL PROTECTED] > > > > > > "DISCLAIMER: This message is proprietary to Aricent and is intended > solely for > > the use of the individual to whom it is addressed. It may contain > privileged > > or confidential information and should not be circulated or used for any > > purpose other than for what it is intended. If you have received this > message > > in error,please notify the originator immediately. If you are not the > intended > > recipient, you are notified that you are strictly prohibited from using, > > copying, altering, or disclosing the contents of this message. Aricent > accepts > > no responsibility for loss or damage arising from the use of the > information > > transmitted by this email including damage from virus." > > ____________________________________________________________________ > > List archives: > > http://www.mail-archive.com/intermapper-talk%40list.dartware.com/ > > To unsubscribe: send email to: [EMAIL PROTECTED] > > > > ____________________________________________________________________ > List archives: > http://www.mail-archive.com/intermapper-talk%40list.dartware.com/ > To unsubscribe: send email to: [EMAIL PROTECTED] ____________________________________________________________________ List archives: http://www.mail-archive.com/intermapper-talk%40list.dartware.com/ To unsubscribe: send email to: [EMAIL PROTECTED]
