Hi Gary
If you have a conversation between A and B (SRC=A, DST=B) and the traffic
passes via Router X and Y. If both X and Y send netflow records (v5 or v9) to
the NTOP Collector then the Collector will be receiving the same conversation
record twice, once from X and once from Y. If we count both records, then we
are double counting. De-duplication eliminates one of the two records, as there
is a recognition that it is the same record.
Thanks
Allan
Gary Gatten <[EMAIL PROTECTED]> wrote:
v\:* {behavior:url(#default#VML);} o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);} .shape {behavior:url(#default#VML);}
st1\:*{behavior:url(#default#ieooui) } I dont know what you
mean about deduplication in this context.
I think Cisco (and probably many others) have the v5 and v9 record formats.
Should be pretty easy to compare them. In fact, I recall seeing something on
Ciscos website about diffs between v5 and v9 records.
G
---------------------------------
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of A H
Sent: Monday, December 03, 2007 2:50 PM
To: [email protected]
Subject: [Ntop] NTOP and de-duplication
My first email to the NTOP list, so my apologies if this has already been
asked and answered, butI have not seen the answer
1. Does NTOP perform de-duplication?
2. Trying to determine what v5 and v9 netflow attribute does NTOP parse and
for attributes that it does not, how easy it would be to add them
Thanks
---------------------------------
Never miss a thing. Make Yahoo your homepage.
"This email is intended to be reviewed by only the intended recipient and
may contain information that is privileged and/or confidential. If you are
not the intended recipient, you are hereby notified that any review, use,
dissemination, disclosure or copying of this email and its attachments, if
any, is strictly prohibited. If you have received this email in error,
please immediately notify the sender by return email and delete this email
from your system."
---------------------------------
Never miss a thing. Make Yahoo your homepage._______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
