Hey Ivan and Prakash, On Wed, Mar 01, 2006 at 11:02:34AM +0000, Ivan A. Beveridge wrote:
> To the best of my knowledge (I'm pretty certain) netflow is layer3+ so > will never show layer2 (eg MAC addresses). MAC addresses are shown in > sflow (picked up by sfacctd), and probably also picked up by those using > pmacctd. This assumption about NetFlow has been broken by NetFlow v9. Its export format is matter of RFC3954: http://www.rfc-archive.org/getrfc.php?rfc=3954 There is room for MPLS labels, VLAN IDs, MAC addresses and it's pretty extendible by a vendor standpoint. As far as i know, NetFlow v9 should be still not available on the Juniper side; while it is on Cisco IOS >= 12.3. I've been able to extract meaningful data from such fields over the time - it definitely seems not hype stuff just segregated into an export format RFC :-) Cheers, Paolo
