Re: [Cflowd] Cflowd and Catalyst5505

From: Saulius R. (saulius.riauba@sc.vu.lt)
Date: Tue May 28 2002 - 07:31:50 PDT

  • Next message: dxnhappy: "[Cflowd] time for the same source ip and des ip ?"

    dst IP only Multicast----- Original Message -----
    From: Saravia, Jovanny - (Col)
    To: 'Saulius Riauba'
    Sent: Monday, May 27, 2002 4:09 PM
    Subject: RE: [Cflowd] Cflowd and Catalyst5505

    > Hi Saulius,
    > I saw your e-mail wrote some days ago. I am interesting to know if is
    > possible to measure flow in switches . What kind of answer did you have
    > about this question ?
    > This is possible, ? because I am sure that Catalyst 6500 could support
    > flows but is because have the routing module.
    > Rgds, Jovanny Saravia

    Hi,

    by that day I have found out, that Cisco switches (without any module)
    support some NDE version, which however not serve for data collection using
    Cflowd. For that purpose a switch needs to have a somekind module like RSM,
    NFFC, RSFC (look below) which could make him to act at this aspect like
    router. (Correct me please if I am not right.)

    But I think there must be a possibility to collect NetFlow data from
    switches without any module, but only by SNMP protocol (using MIB commands)
    (not using Cflowd). For example I am using Cricket
    (http://cricket.sourceforge.net/) for observing the network flows (but not
    for data collection) from routers and from switches too, and not only from
    Cisco. It’s a pity that Cricket not provides data collection or aggregation
    like do Cflowd.

    In Cisco WebPages
    http://www.cisco.com/warp/public/cc/pd/si/casi/ca5000/prodlit/764_pb.htm we
    read:

    “With NetFlow Data Export (NDE), the performance management capabilities of
    the Catalyst switches have now been extended to provide comprehensive
    monitoring of all inter-subnet flows passing through the NFFC and the RSM. A
    new NetFlow Data Export version 7 format is supported from the Catalyst 5000
    with a NFFC when it is performing Layer 3 switching.”

    About NDE and MLS Management:
    http://www.cisco.com/univercd/cc/td/doc/product/lan/cat5000/rel_5_2/layer3/n
    de.htm#41001

    “You can use NDE to monitor all IP Multilayer Switching (MLS) intersubnet
    traffic through the NetFlow Feature Card (NFFC) or NFFC II and the Route
    Switch Module (RSM), Route Switch Feature Card (RSFC), or externally
    attached router. NDE complements the embedded Remote Monitoring (RMON)
    capabilities on the switch that allow you to see all port traffic.”

    Regards
    Saulius Riauba

    _______________________________________________
    Cflowd mailing list
    Cflowd@caida.org
    http://login.caida.org/mailman/listinfo/cflowd



    This archive was generated by hypermail 2.1.4 : Tue May 28 2002 - 07:51:57 PDT