[AusNOG] Netflow

[Chris Chaundy]

Hi David,

I'm not sure if it has been made clear earlier in this thread but people need to understand that all the netflow AS information is derived from your local router BGP tables.

This actually raises an interesting point with some upcoming changes to the multi-lateral peering arrangements at Equinix (next week).  By default, the new route servers will advertise routes without the Equinix AS appearing in the AS-path (so-called 'transparent AS').  Apart from making paths one AS shorter, it may also confuse traffic analysis using the 'peer AS' view as you won't be able to tell between directly connected and via-IX route paths (this may depend on how the peer AS info is derived on the router).

In any case, we are opting to keep the (new) Equinix AS path visible in our paths at this time.  Unless you local-pref any bilateral peering sessions over the IX fabric, this may also get broken (depending on BGP best path tie-breakers).

Cheers, Chris

Sent from my iPhone

On 15/07/2011, at 9:14, David Hughes <David at Hughes.com.au> wrote:

> 
> Hey Lincoln,
> 
> On 15/07/2011, at 8:53 AM, Lincoln Dale wrote:
> 
>> certainly there are 3rd party netflow tools that attempt to derive the 'path' and some tools that help model questions like "if i peer with AS X how will that influence my traffic", but netflow itself does not provide that analysis and any tools that do so will be based on a bunch of assumptions that are typically never 100% correct.
> 
> Sure, 100% correct isn't going to be possible, but by coupling netflow data and your routing table the results _should_ be very useful.  Naturally, that doesn't include any local routing policies of the transit AS's between src and dst but it should be a fair approximation.
> 
> 
> David
> ...
> 
> 
> _______________________________________________
> AusNOG mailing list
> AusNOG at lists.ausnog.net
> http://lists.ausnog.net/mailman/listinfo/ausnog