|
That's pretty much EXACTLY what it does. AS gives you
a way to consolidate sparse addresses, without using sub/supernets or
filtering.
The
downside is that aggregated means you lose the
detail.
It may be that what you really need is a "Dump AS"
option in rrdplugin (like "Dump Domains"). That preserves the
detail. The code wouldn't be that hard to write w/ the model from Dump
Domains. Have fun!
-----Burton
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Hally Sent: Thursday, March 10, 2005 1:45 PM To: '[email protected]' Subject: RE: [Ntop] Netflow aggregation So what does doing the
AS aggregation in Ntop buy me? I'm not sure I follow that
part. Essentially it would be
helpful to be able to take a timeframe, (say monthly) and be able to see that we
passed X-amount of data to-and-from that AS. I'm looking to do this
because we currently get billed based on usage for traffic to
If the above isn't
currently available, I'd definitely be interested in getting involved in moving
this to Ntop-dev and helping out anyway I can. Thanks! From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Burton Strauss If you aren't going to
use the netflow aggregation, then this becomes an rrd
issue. Unfortunately, the
summation (aggregation) scenario is the one that hurts re rrd - you can't just
accumulate into an rrd. One update per second is all it will
accept. So, to add RRDs by AS,
you would need to walk the HostTraffic structure, summing in memory and then do
one update per AS. "Dump Domains" is the model - it's not THAT hard to add
the code (but let's move this to ntop-dev if you're
interested). ----- From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Hally Thanks What I'm looking to do
is to gather usage stats based on AS. I'm currently aggregating based on
AS at the border routers and doing no aggregation via Ntop, and I think that's
working out ok. One question I have is,
is there a way to keep the AS Info stats (RRD?) so that when the process gets
restarted I don't lose what's reported under Summary/AS
Info? Thanks! From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Burton Strauss Basically, it's what
YOU need it to be to meet YOUR needs. Aggregating at the
router (netflow collector, technically) reduces the amount of bandwidth consumed
for monitoring (and reduces the load on ntop). But it's more difficult
(sometimes) to change the collector options. Aggregating in ntop is
easy to change (just flip the dropdown). But it means ntop is processing
each flow. Whichever way you
aggregate, that's the level of detail ntop reports. No drill-down,
etc. just the aggregated data. ----- From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Hally Hello
All, Can someone tell me what the
benefits of the different netflow aggregation options are? Is it better to
not aggregate at the router, and then set up aggregation on Ntop, or should they
'line up', meaning, set AS aggregation on the router and also in
ntop? I guess which type of aggregation
you choose will also effect the type of reporting that Ntop is going to produce,
correct? Thanks in
advance! |
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
