On Wed 05 Jul 2006 10:13, Ivan A. Beveridge wrote: > Hi all, > > On 05/07/2006 00:07, Paolo Lucente wrote: > > while the idea of integrating a kind of sFlow/NetFlow probe has been > > already considered (i remember some thoughts recently exchanged with > > Sven Anderson about this), i'm somewhat not fully convinced. > > > > In a first instance it will take time as it's absolutely not trivial; > > this has been correctly noted by Ivan and somewhat answers to the > > question from Peter. > > > > But my point is the following: out there we already have a range of > > NetFlow probes, ie. softflowd, nprobe, fprobe to name a few; don't > > actually know if exists any for sFlow (out of curiosity, Ivan, can > > you confirm this ?). There is also choise for replicators, ie. UDP > > samplicator, flow-fanout - which is part of flow-tools. > > To the best of my knowledge the only open-source software that outputs > sflow data is ntop (I'm not sure whether the "slightly commercialised" > nprobe also does). The only piece of software that I know that converts > sflow -> netflow is inmon's sflowtool. sflowtool will also do fanout > (both sflow -> sflow and sflow -> netflow). > > My requirement is to take in sflow data, filter it on MAC address and > output multiple streams based on the filters (1 stream showing in and > out for a particular MAC). This is similar to taking a netflow stream, > splitting into per-port netflow and then exporting these netflow streams > (except more complicated). > > Basically what I need must act as a (sflow) collector, filter [I think > pmacct will do both of these] and then act as an agent/probe to convert > that filtered data back to sflow/netflow ... and I can't think that any > tool combination will do this.
Yes. That was the reason for suggesting a netflow/sflow backend plugin for pmacct.... > I *know* my requirement is non-trivial, and I suspect I'm in a rather > unique position in wanting/needing this (with the possible exception of > other IXes) ... having customers that want to parse their own > sflow/netflow data from our network kit. Non-trivial yes.. However it is something I think I will need to do also which is the reason I asked about it :-) I am also having some technical problems with nprobe that don't exist with pmacct... Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc
pgpLkpMP04OnT.pgp
Description: PGP signature
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
