Mailing List Archive

On Fri, Nov 18, 2005 at 11:03:38PM +0100, Olivier Marc wrote:
> Hi,
> I search a simple method to use sflow or equivalent solution with ironcores
> modules (ex. :NI4GMR).
What do you wish to accomplish?

I am currently sampling sFlow data to collect
statistics over to which ASs our traffic is going.
It's rather simple, sflow-tools together with a
homebuilt perl script.

There's not many of-the-shelf products available
for sFlow but if you're handy with Perl you can do
most of it yourself.

Please provide a bit more information on what you
actually want to do and I will try to help you out
further :)

Kristian.

If I remember correctly there is no hardware sflow sampling in IronCore.
Your only option then is an external host running an sflow probe, and
mirror ports. InMon makes one:

http://www.inmon.com/products/probes.php

I use InMon's Traffic Server...it's pretty fantastic once you learn to
use it. I do wish it was a little more 'open'. I would love to access
whatever dB they use with my own scripts.

Last I checked NTOP had some very limited sflow reporting, using the
sflow-tools freely distributed by InMon, it was pretty minimal though:
http://www.ntop.org

-----Original Message-----
From: foundry-nsp-bounces@puck.nether.net
[mailto:foundry-nsp-bounces at puck.nether.net] On Behalf Of Kristian
Larsson
Sent: Friday, November 18, 2005 2:25 PM
To: Olivier Marc
Cc: foundry-nsp at puck.nether.net
Subject: Re: [f-nsp] Sflow and/or measurement

On Fri, Nov 18, 2005 at 11:03:38PM +0100, Olivier Marc wrote:
> Hi,
> I search a simple method to use sflow or equivalent solution with
ironcores
> modules (ex. :NI4GMR).
What do you wish to accomplish?

I am currently sampling sFlow data to collect
statistics over to which ASs our traffic is going.
It's rather simple, sflow-tools together with a
homebuilt perl script.

There's not many of-the-shelf products available
for sFlow but if you're handy with Perl you can do
most of it yourself.

Please provide a bit more information on what you
actually want to do and I will try to help you out
further :)

Kristian.

_______________________________________________
foundry-nsp mailing list
foundry-nsp at puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp

Cliff Fogle wrote:

>If I remember correctly there is no hardware sflow sampling in IronCore.
>Your only option then is an external host running an sflow probe, and
>mirror ports. InMon makes one:
>
>http://www.inmon.com/products/probes.php
>
>I use InMon's Traffic Server...it's pretty fantastic once you learn to
>use it. I do wish it was a little more 'open'. I would love to access
>whatever dB they use with my own scripts.
>
>Last I checked NTOP had some very limited sflow reporting, using the
>sflow-tools freely distributed by InMon, it was pretty minimal though:
>http://www.ntop.org
>
>
If it doesn't *have* to be sflow, then there are several free
netflow-based solutions using port mirroring and a unix box. I have had
some success with FreeBSD and it's ng_netflow module with flow-tools,
for instance. I believe ntop can collect netflow data too, as can nprobe.

Best Regards,

Howard

> If it doesn't *have* to be sflow, then there are
> several free
> netflow-based solutions using port mirroring and a
> unix box. I have had
> some success with FreeBSD and it's ng_netflow module
> with flow-tools,
> for instance. I believe ntop can collect netflow
> data too, as can nprobe.
>
Thanks all for your answer (and sorry for my poor
english :) )

But the mirroring solution, which consequence implies
?
Which is the limit ?

It would be necessary that this solution can support a
network of 1,5Gbps...

Thanks in advance.

O. Marc






___________________________________________________________________________
Appel audio GRATUIT partout dans le monde avec le nouveau Yahoo! Messenger
T?l?chargez cette version sur http://fr.messenger.yahoo.com

On Sun, Nov 20, 2005 at 12:23:34AM +0100, Olivier Marc wrote:
> > If it doesn't *have* to be sflow, then there are
> > several free
> > netflow-based solutions using port mirroring and a
> > unix box. I have had
> > some success with FreeBSD and it's ng_netflow module
> > with flow-tools,
> > for instance. I believe ntop can collect netflow
> > data too, as can nprobe.
> >
> Thanks all for your answer (and sorry for my poor
> english :) )
>
> But the mirroring solution, which consequence implies
> ?
> Which is the limit ?
>
> It would be necessary that this solution can support a
> network of 1,5Gbps...
Is that bidirectional?
PF_RING could perhaps be of assistance, but I'm
doubtful it will pull off 1,5Gbps.

1,5Gbps is a funny figure. is that perhaps 750Mbit
bidirectional traffic? or 1,5 on a 10gbps
interface?
if the latter you actually have 3gbps of traffic.
if the former you could perhaps split the job onto
two machines.

hardware wise I would recommend Opteron as they
have superior memory bandwidth compared to
anything else. Couple that with PCI-express based
networks cards and you will have no IO transaction
limits (you'll get wirespeed gigg).

Kristian

>
>
>
>
>
> ___________________________________________________________________________
> Appel audio GRATUIT partout dans le monde avec le nouveau Yahoo! Messenger
> T?l?chargez cette version sur http://fr.messenger.yahoo.com
> _______________________________________________
> foundry-nsp mailing list
> foundry-nsp at puck.nether.net
> http://puck.nether.net/mailman/listinfo/foundry-nsp