Hi all, Paolo Lucente, 05.07.2006 01:07: > while the idea of integrating a kind of sFlow/NetFlow probe has been > already considered (i remember some thoughts recently exchanged with > Sven Anderson about this), i'm somewhat not fully convinced.
[...] > Integrating either the probe or the replicator into any pmacct > daemon will be certainly useful but would also result in a not > proper approach, in my opinion. > > Comments, any thoughts ? pmacct is already a probe, since you have the pcap interface and, more important, you do L7 classification, which is clearly a probe-task. As we discussed before in private mails, I would love to see some features of pmacct also on a lightweight probe. It would be nice, if pmacct would evolve to a modular flow processing framework, where you can also compile a smaller version with pcap import and Netflow/IPFIX/sFlow exporters and L7 classification API. Maybe it makes sense to tear apart the probe/exporter and collector parts in general, because in the case you are running both on the same machine, you anyway don't have performance in mind, and you can just send it by local IP-traffic from the exporter to the collector. And the collector part should also offer an abstract data access API, so that the data processing applications don't depend on the database and format, that the collector is using. >From the existing probes it seems only nProbe offers some kind of L7 analysis. (VoIP stuff, i think.) I know, lots of "wise words", but I'm also disposed to offer some time for coding within my means. Cheers, Sven -- Sven Anderson Institute for Informatics - http://www.ifi.informatik.uni-goettingen.de Georg-August-Universitaet Goettingen Lotzestr. 16-18, 37083 Goettingen, Germany _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
