We are using and have had great success with pf_ring and nprobe for creating flow records to send to nfdump/nfsen. Our current nfdump/nfsen server is starting to have trouble keeping up. I was wondering if anyone has used pf_ring with nfcapd and if it is worth the effort.
The other half is how should we distribute collection and presentation going forward for scalability? We can run nfcapd on multiple servers, but what's the best way then to integrate it with nfsen? Should we simply rsync all the flow files to another server? Any potential pitfalls with that, other than some additional delay in displaying flow data? Thanks and regards, -Robin ------------------------------------------------------------------------- This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Don't miss this year's exciting event. There's still time to save $100. Use priority code J8TL2D2. http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone _______________________________________________ Nfdump-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
