in the past months I have developed a new flow format named nFlow that I have proposed (with little luck so far) to IETF in order to influence the design of the IPFIX (http://ipfix.doit.wisc.edu/) flow format. Based on the comments received, I have updated the flow definition and based on NetFlow v9 (this was the main concern). At http://www.nflow.org/ you can find the nFlow specs and download a new prerelease version of nProbe (a software NetFlow probe I have developed) that supports both NetFlow v5/v9 and nFlow, so that you can play with nFlow and compare it with NetFlow.
ntop definitively needs to support NetFlowV9. I have designed nFlow in order to be a better NetFlow and to use it for allowing ntop to run at Gbit speeds. In fact the way ntop works (capture a packet, analyze the packet, update several data structures, drop the packet) does not allow it to scale easily. My idea is that we need an external probe that feeds ntop with a rich flow format (richer than NetFlow v5 for instance) so that ntop needs to handle much less data than today.
I would very much appreciate to receive you feedback on this work.
Thanks, Luca
-- Luca Deri <[EMAIL PROTECTED]> http://luca.ntop.org/ Hacker: someone who loves to program and enjoys being clever about it - Richard Stallman
_______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
