-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Robin,
- --On April 11, 2008 9:49:10 -0400 "Brown, Robin" <[EMAIL PROTECTED]> wrote:
|
| We are using and have had great success with pf_ring and nprobe for
| creating flow records to send to nfdump/nfsen. Our current nfdump/nfsen
| server is starting to have trouble keeping up. I was wondering if
| anyone has used pf_ring with nfcapd and if it is worth the effort.
What kind of problems did you run into? There was not really a change in recent
collector code.
|
| The other half is how should we distribute collection and presentation
| going forward for scalability? We can run nfcapd on multiple servers,
| but what's the best way then to integrate it with nfsen? Should we
| simply rsync all the flow files to another server? Any potential
| pitfalls with that, other than some additional delay in displaying flow
| data?
So far NfSen is not yet designed to have the collector apart from the
presentation host.
Anyway, you can rsync the data to the NfSen host. Set the port number in the
config of each netflow source to 0 and make sure
that you do not run into syncing problems. New files should appear latest 30s
after a complete 5min slot on that host,
otherwise the update is not successful. You might need some small changes to
handle syncs properly ..
- Peter
|
| Thanks and regards,
|
| -Robin
|
|
| -------------------------------------------------------------------------
| This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
| Don't miss this year's exciting event. There's still time to save $100.
| Use priority code J8TL2D2.
| http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
| _______________________________________________
| Nfdump-discuss mailing list
| [email protected]
| https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
iQCVAwUBSAMNRf5AbZRALNr/AQKl/gP/c6HXqH5G9B41RKi+VpjdYk6JHjPiCyHF
TZnm8d7MOZXUE2PGjs5i9cP7XydC1J8vEarEo1+DDP7UOiHsTcnU1CBt82ccOoeZ
gLyYzvuY3aToV6nctPjBSs09p8nPUpdzX7HD01IDOU7IffbDQ8xz5Hf0dGPxjLt6
k/45gsmmMqw=
=XXDS
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
Nfdump-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
