Ah - I see. To my knowledge nTop does no deduplication of this sort.
You can setup a different netflow device (interface) for each router using a unique udp port, that may help. Or, if you understand the flows in your network you can more selectively apply netflow to certain interfaces in specific directions (ingress or egress) to minimize duplication. Maybe combine this with separate unique interfaces and BPF's - although I'm not sure BPF's can be applied to netflow devices. There is another type of filter someone else used on netflow devices - but I forget. G ________________________________ From: A H [mailto:[EMAIL PROTECTED] Sent: Monday, December 03, 2007 5:43 PM To: Gary Gatten; [email protected] Subject: RE: [Ntop] NTOP and de-duplication Hi Gary If you have a conversation between A and B (SRC=A, DST=B) and the traffic passes via Router X and Y. If both X and Y send netflow records (v5 or v9) to the NTOP Collector then the Collector will be receiving the same conversation record twice, once from X and once from Y. If we count both records, then we are double counting. De-duplication eliminates one of the two records, as there is a recognition that it is the same record. Thanks Allan Gary Gatten <[EMAIL PROTECTED]> wrote: I don't know what you mean about deduplication in this context. I think Cisco (and probably many others) have the v5 and v9 record formats. Should be pretty easy to compare them. In fact, I recall seeing something on Cisco's website about diffs between v5 and v9 records. G ________________________________ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of A H Sent: Monday, December 03, 2007 2:50 PM To: [email protected] Subject: [Ntop] NTOP and de-duplication My first email to the NTOP list, so my apologies if this has already been asked and answered, butI have not seen the answer 1. Does NTOP perform de-duplication? 2. Trying to determine what v5 and v9 netflow attribute does NTOP parse and for attributes that it does not, how easy it would be to add them Thanks ________________________________ Never miss a thing. Make Yahoo your homepage. <http://us.rd.yahoo.com/evt=51438/*http:/www.yahoo.com/r/hs> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." ________________________________ Never miss a thing. Make Yahoo your homepage. <http://us.rd.yahoo.com/evt=51438/*http:/www.yahoo.com/r/hs> <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
