I answer this one first. > Currently we are using mirror ports on two HP switches, going into > our > pmacct machine which has several interfaces all in promiscuous mode. > At peak > it can be collecting 70MBps of data throughput from the switches. We > are > only interested at this point in tracking src_host, dst_host, bytes, > packets, vlan. It has 200GB of storage available which it regularly > fills up but this is > not such a problem as we archive data regularly from the database.
You fill 200GB regulary? Then most probably you are not aggregating properly nor removing older data. > Since the data accounting is used for billing it needs to be 100% > accurate. > The amount of traffic will be increasing significantly in future and > throwing more hardware at the issue is only going to get us so far. As somebody already has pointed you, ISP dont bill on 100% precise data. Actually, Cisco designed nF with this in mind so its something enough for billing. > I guess my question at this point is, what do you do when you have say > 1GBps > of traffic to record and you need 100% accuracy? In this particular cases they do the following: 1) Pray 2) Prepare a deeeep pocket 3) Sample !!! Or use cards like the ones from Endace: http://www.endace.com -------------------------------------------- Jaime Nebrera - [EMAIL PROTECTED] Consultor TI - ENEO Tecnologia SL Pol. PISA - C/ Manufactura 6, P1, 3B Mairena del Aljarafe - 41927 - Sevilla Telf.- (+34) 955 60 11 60 / 619 04 55 18 _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
