[AusNOG] Inline TAP to extract flow data?

[Mark Tees]

Nprobe with some PCAP syntax filtering has worked for me in the past.
Painful yes but I does work. Check out their hardware recommendations.

On Sunday, August 24, 2014, Andrew Yager <andrew at rwts.com.au> wrote:

>  Hi,
>
> Last night reminded me of my long standing hate of juniper's inability to
> fix the issue between rpd and sampled and why we've been looking at
> upgrading to 240s or 480s.
>
> As an alternative, given what we do with flow collection and analysis, it
> could be much better/cost effective to put inline taps and sample off
> device.
>
> Is anyone else doing this (port mirror or other)?
> Any recommendations on hardware (multiple 10G and 1G interfaces in 6
> locations to be sampled)?
>
> Obviously looking to come out cheaper, but with some level of reliability
> still ;)
>
> Currently we are using nfsen for flow analysis if it helps with any
> recommendations.
>
> Andrew
> --
> Andrew Yager, Managing Director   MACS (Snr) CP BCompSc MCP
> Real World Technology Solutions Pty Ltd - IT people you can trust
> ph: 1300 798 718 or (02) 9037 0500
> fax: (02) 9037 0591
> http://www.rwts.com.au/
>


-- 
Regards,

Mark L. Tees
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20140824/f3d66aff/attachment.html>