-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 05/07/2006 08:13, Ivan A. Beveridge wrote: > On 05/07/2006 00:07, Paolo Lucente wrote: >>> while the idea of integrating a kind of sFlow/NetFlow probe has been >>> already considered (i remember some thoughts recently exchanged with >>> Sven Anderson about this), i'm somewhat not fully convinced.
>>> But my point is the following: out there we already have a range of >>> NetFlow probes, ie. softflowd, nprobe, fprobe to name a few; don't >>> actually know if exists any for sFlow (out of curiosity, Ivan, can >>> you confirm this ?). There is also choise for replicators, ie. UDP >>> samplicator, flow-fanout - which is part of flow-tools. > > To the best of my knowledge the only open-source software that outputs > sflow data is ntop (I'm not sure whether the "slightly commercialised" > nprobe also does). The only piece of software that I know that converts > sflow -> netflow is inmon's sflowtool. sflowtool will also do fanout > (both sflow -> sflow and sflow -> netflow). I should add Como ( http://como.intel-research.net/ ) to that list .. the sflow v2 support is getting there (I'm trying to help, as an outsider). Being a "framework" that is where I was/am pinning my hopes for my particular requirement, but I have not been able to try it yet. > My requirement is to take in sflow data, filter it on MAC address and > output multiple streams based on the filters (1 stream showing in and > out for a particular MAC). This is similar to taking a netflow stream, > splitting into per-port netflow and then exporting these netflow streams > (except more complicated). > > Basically what I need must act as a (sflow) collector, filter [I think > pmacct will do both of these] and then act as an agent/probe to convert > that filtered data back to sflow/netflow ... and I can't think that any > tool combination will do this. > > I *know* my requirement is non-trivial, and I suspect I'm in a rather > unique position in wanting/needing this (with the possible exception of > other IXes) ... having customers that want to parse their own > sflow/netflow data from our network kit. Cheers Ivan - -- Ivan Beveridge <[EMAIL PROTECTED]> http://www.linx.net/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD4DBQFEq2nLQQZN5jq7vncRAulPAKC4C4Ys+lgXprwqkMDkq2z5LSUqRgCVHGBv I75VtMJ618NQVYXg119c2Q== =vB/3 -----END PGP SIGNATURE----- _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
