I haven't looked @ Luca's code - I don't know whether he changed this and forgot to update the docs or what... it certainly used to be true (netFlow data went into myGlobals.device[0].xxxxx).
-----Burton > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of > Jon Garlock > Sent: Wednesday, August 04, 2004 8:05 AM > To: [EMAIL PROTECTED] > Subject: RE: [Ntop] NetFlow (the dumb newbie is back! Heh) > > > > As soon as I activate the NetFlow plug-in, interface merging is > disabled. I just popped into the Switch NIC page on another NTOP > install we have, and it says: > > Note that the NetFlow and sFlow plugins - if enabled - force -M to be > set (i.e. they disable interface merging). > > Thanks, > Jon. > > -----Original Message----- > From: Burton M. Strauss III [mailto:[EMAIL PROTECTED] > Sent: Tuesday, August 03, 2004 5:19 PM > To: [EMAIL PROTECTED] > Subject: RE: [Ntop] NetFlow (the dumb newbie is back! Heh) > > Actually the default handling of netFlow is to merge them all. Luca > just committed to the cvs the ability to handle multiple distinct > netFlow's, but I assume the old merge behavior remains available. > > -----Burton > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of > > > Jon Garlock > > Sent: Tuesday, August 03, 2004 3:39 PM > > To: [EMAIL PROTECTED] > > Subject: [Ntop] NetFlow (the dumb newbie is back! Heh) > > > > > > > > First off, thanks to everyone on the list for the help in the past. > > I've now got 6 linux machines running ntop at 6 sites here at our org. > > That could never have happened without your help :) Between MRTG and > > NTOP, this has been one hell of a year. It's damned nice to know > > what's going on .. > > > > Anyways, enough ass kissing. But I felt it necessary to prep as I've > > got a couple of dumb newbie questions. Not so much how-to questions, > > but .. eh, you'll see. > > > > Now that we're up, running, collecting and reporting with ntop, I'd > > like to shake things up by testing working with netflow. We're > > cisco-everywhere, so it shouldn't be a problem. > > > > I've read through the "NTop, NetFlow and Cisco Routers" document by > > Jonathan Feldman (sorry, no URL handy). Using that doc, I've been > > able to collect and report on netflow statistics. Great! :) > > > > Now for my question (and I probably could have just jumped right > here): > > is it possible to merge netflow statistics? I know, by default, it's > > not. Simply activating the netflow plug-in forces all interfaces to > > be reported seperately. Is there some type of workaround? > > > > This is why I'm asking: at our primary site, we have 3 major WAN > links. > > As it stands now, I'm sniffing that data with the ntop box which has > > an interface on each of those critical segments (core to primary WAN > > router (frame relay), core to secodnary WAN router (collection of > > point to point t1's) and core to firewall). > > > > With ntop now, I merge all this traffic and get a great "complete > > picture" of what folks are up to. > > > > If I were to switch to 3 NetFlow's, I'd have to constantly switch > > between them to get a good idea of what's going on. It has to do with > > > the way our network passes traffic. For example, a user in a remote > > office requests a web page. His local router decides that traffic is > > best routed over the t1. It arrives at HQ on the secondary router and > > > hops directly over to the firewall, as it's the gateway of last > resort. > > Internet magic happens, and the data from the users request comes back > > > in. The router in HQ decides to send it over frame relay. > > > > I'd have to look at 3 separate netflow interfaces to get the > "complete" > > picture .. at least from here at HQ. > > > > Is this making sense? Am I overlooking something stupid that makes my > > > question moot? Is this something that's in my newbieness I missed was > > > asked each week for the last 30 weeks in the archive? Heh. I hope > > not > > :) > > > > Thanks and sorry for the freakin' BOOK of an email for a simple > > question. > > > > Thanks, > > Jon. > > -------------------------------------------------------- > > The information in this transmission is privileged and confidential > > and intended only for the recipient listed above. If you are not the > > intended recipient, please advise the sender immediately by reply > > e-mail and delete this message and any attachments without retaining a > > > copy. If you are not the intended recipient, you are hereby notified > > that any disclosure, copying or distribution of this message, or the > > taking of any action based upon it, is strictly prohibited. > > Thank you. > > > > > > > > _______________________________________________ > > Ntop mailing list > > [EMAIL PROTECTED] > > http://listgateway.unipi.it/mailman/listinfo/ntop > > _______________________________________________ > Ntop mailing list > [EMAIL PROTECTED] > http://listgateway.unipi.it/mailman/listinfo/ntop > > _______________________________________________ > Ntop mailing list > [EMAIL PROTECTED] > http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
