Re: [Cflowd] Flow-export data format supported

From: Benoit Claise (bclaise@cisco.com)
Date: Thu Apr 25 2002 - 02:47:41 PDT

  • Next message: Jerome Bertsch: "[Cflowd] cflowd vs flowtool"

    Hi,

    >
    >
    > In a version 8 flow-export data format, what are the data fields contained
    > in each flow?

    http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/nfc/nfc_3_5/iug/tuning.htm#xtocid13

    Look for "2" in the table, "2" meaning:
    2 Compatible only with Version 8 export data. On-router aggregation is required.

    >
    >
    > If the data fields are different than that of the version 5 format, my
    > current netflow database
    > will be able to store the data.
    >
    > What aggregation schemes are good to apply?

    Well, it only depends what you are trying to achieve? What are the netflow
    collected for?
    Simply list the fields that you need and find the smallest aggregation.

    Regards, Benoit

    >
    >
    > Yours,
    > Edwin
    >
    > ----- Original Message -----
    > From: "Frank Reimer" <f.reimer@celox.de>
    > To: ""Edwin D. Viņas"" <edwinv@asti.dost.gov.ph>
    > Sent: Wednesday, April 24, 2002 4:29 PM
    > Subject: Re: [Cflowd] Flow-export data format supported
    >
    > Frank> Hi Edwin,
    >
    > Frank> yes, cflowd recognize Flow v8 exports and store it in the same way v5
    > Frank> flows where stored. I used Flow 8 with my Junipers and cflowd
    > received
    > Frank> them and stored them in the arts files.
    > Frank> Due to some trouble with the flow exporter on the Junipers i switched
    > Frank> back to Flow 5 but, this was _not_ a cflowd prob. It was a juniper
    > Frank> prob.
    >
    > Frank> rgds,
    > Frank> Frank
    > >
    > > Edwin> Hi guys!
    > >
    > > Edwin> Im currently using CFLOWD to collect netflow from a router using
    > version 5 data export format.
    > > Edwin> Im contented with the functionality of CFLOWD but, we planned to
    > apply
    > > Edwin> aggregation scheme inorder to reduce the data being exported by the
    > routers.
    > >
    > > Edwin> However, there is a documentation from Cisco which says that only
    > Version 8 UDP
    > > Edwin> flow-export data format is being supported with aggragated flows.
    > This means im now
    > > Edwin> going to receive version 8 instead of version 5 flow-exports.
    > >
    > > Edwin> My problem is, can CFLOWD recognize VERSION 8 FLOW-EXPORTS?
    > >
    > >
    > > Edwin> Yours,
    > >
    > > Edwin> Edwin D. Viņas
    > > Edwin> Advanced Science and Technology Institute
    > > Edwin> CP Garcia Ave, UP Diliman
    > > Edwin> Quezon City PHILIPPINES
    > >
    > > Edwin> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    > > Edwin> "In the world of science, nothing is impossible."
    > >
    > > Edwin> Edwin D. Viņas
    > > Edwin> http://www.geocities.com/edwin_vinas
    > > Edwin> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    > >
    >
    > _______________________________________________
    > Cflowd mailing list
    > Cflowd@caida.org
    > http://login.caida.org/mailman/listinfo/cflowd

    _______________________________________________
    Cflowd mailing list
    Cflowd@caida.org
    http://login.caida.org/mailman/listinfo/cflowd



    This archive was generated by hypermail 2.1.4 : Thu Apr 25 2002 - 03:01:22 PDT