NetFlow requires much less of a robust hardware setup than the "packet sniffing" scenario. Your current box would probably work for the NetFlow job. I have a 2.8GHz Xeon/1024MB DRAM box with a Broadcom gigabit, server class NIC and I was dropping lots of packets on a steady 15-20 Mbps stream of traffic. If you can live without MAC address and OS info, which it doesn't sound like you'd be able to get with your configuration anyway, I'd just go with NetFlows. I would at least upgrade the memory in your current box if nothing else, though.
-Chris -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Neal Rauhauser Sent: Thursday, March 24, 2005 3:49 AM To: [email protected] Subject: [Ntop] sizing ntop box I am monitoring a link between two ISPs that has many src/dst pairs and runs about four mbits constantly. If either ISP's DS3 fails we expect to see twenty mbits on the link. The current box doing the job is a 1.0 GHz Dell with 384 meg of ram and two 3com 905 ethernet boards. We see 70% utilization occuring pretty regularly, 350 meg of ram used, and consistently lose 20% of packets. I think 3com cards are pretty wimpy - what would be better? Intel etherexpress? Some specialized card? How much ram should I have given an anticipated 5x increase in total traffic and a probable 5x increase in src/dst pairs? What sort of a processor will be required to keep up with this level of activity? I expect to turn on netflow export from the router of the ISP who is hosting the box. What sort of resources will be required to support that? What happens if the other ISP wants to share the services of this box and it has to monitor netflow from two busy DS3s? -- "Now my sails are filling, with winds so willing, and I'm as good as gone again" - Saint of Circumstance _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
