On Thu Oct 26, 2006 at 16:16:17 +0200, Jaime Nebrera wrote: ...
> Sorry, I understood you wrongly, I though you were analysing full payload > for something, my fault > > Still, all I have said is related to geader only information, so still is > valid :) > >> Hopefully someone on list has set something similar up and can point >> me in >> the right direction. > > The main point here is, how fast is your link, and what are the specs of the > probe and/or collector? OK thanks to you and the others that have replied I am starting to get my head around this, although unfortunately it is sounding less and less like sFlow is suitable for our requirements. Currently we are using mirror ports on two HP switches, going into our pmacct machine which has several interfaces all in promiscuous mode. At peak it can be collecting 70MBps of data throughput from the switches. We are only interested at this point in tracking src_host, dst_host, bytes, packets, vlan. It has 200GB of storage available which it regularly fills up but this is not such a problem as we archive data regularly from the database. Since the data accounting is used for billing it needs to be 100% accurate. The amount of traffic will be increasing significantly in future and throwing more hardware at the issue is only going to get us so far. I guess my question at this point is, what do you do when you have say 1GBps of traffic to record and you need 100% accuracy? -- Regards, Oliver Hookins _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
