RE: Capture PCAP data from multiple sources

2018-03-07 Thread Vladimir Shlyakhtin
adimir From: zeo...@gmail.com [zeo...@gmail.com] Sent: Wednesday, March 07, 2018 12:31 PM To: user@metron.apache.org Subject: Re: Capture PCAP data from multiple sources Depending on what you are tapping and your architecture, you may be able to accomplish this upstream.

Re: Capture PCAP data from multiple sources

2018-03-07 Thread zeo...@gmail.com
Depending on what you are tapping and your architecture, you may be able to accomplish this upstream. Do you have a network packet broker? Jon On Wed, Mar 7, 2018, 11:34 Vladimir Shlyakhtin < vladimir.shlyakh...@sstech.us> wrote: > Hello, > > > What is good practice to capture data from

Capture PCAP data from multiple sources

2018-03-07 Thread Vladimir Shlyakhtin
Hello, What is good practice to capture data from multiple sources to avoid duplication of packets. I mean if we have multiple network points (e.g. routers) and capture data from every of these points how to avoid duplication of packets. According to Metron' PCAP docs PCAP topology just stores