Re: Real Time Traffic Flow Measurement - anybody working on it?

On Thu, Apr 19, 2001 at 02:15:56PM +1000, Manfred Bartz wrote: > Through the stimulating discussion we had under ``IP Acounting > Idea for 2.5'', it appears that a separate Traffic Flow Measure- > ment and Accounting sub-system would be useful. See: >

Re: Real Time Traffic Flow Measurement - anybody working on it?

On Thu, Apr 19, 2001 at 02:15:56PM +1000, Manfred Bartz wrote: Through the stimulating discussion we had under ``IP Acounting Idea for 2.5'', it appears that a separate Traffic Flow Measure- ment and Accounting sub-system would be useful. See: http://logi.cc/linux/CounterReset/ Hey

Re: Real Time Traffic Flow Measurement - anybody working on it?

Hi, Michael Clark wrote: > > An obvious kernel improvement for userspace meters like NeTraMet would > be to give libpcap's pcap_read a kernel interface that can return more > than one packet at a time (the libpcap interface has this capability). It's already there - the turbo packet interface

RE: Real Time Traffic Flow Measurement - anybody working on it?

Can't say i'm actively working on it but I've emailed Nevil to see if he knows of any RTFM work that is being done on Linux. Although here's some observations: Userspace pcap meters (such as NeTreMet) can measure traffic IP stack doesn't even see (useful for a probe on a span port for instance)

RE: Real Time Traffic Flow Measurement - anybody working on it?

Can't say i'm actively working on it but I've emailed Nevil to see if he knows of any RTFM work that is being done on Linux. Although here's some observations: Userspace pcap meters (such as NeTreMet) can measure traffic IP stack doesn't even see (useful for a probe on a span port for instance)

Re: Real Time Traffic Flow Measurement - anybody working on it?

Hi, Michael Clark wrote: An obvious kernel improvement for userspace meters like NeTraMet would be to give libpcap's pcap_read a kernel interface that can return more than one packet at a time (the libpcap interface has this capability). It's already there - the turbo packet interface