Re: [Cflowd] netflow accounting

From: Mark Fullmer (maf@eng.oar.net)
Date: Mon Nov 25 2002 - 19:37:06 PST

  • Next message: Nazeeh Khatim: "[Cflowd] RE: AS analysis using cflowd"

    On Tue, Nov 19, 2002 at 01:09:36PM -0500, Edson Manners wrote:
    > I use a perl script that pipes flow-recieve to flow-print and then pipes the
    > output from flow-print as the input for the perl script. This script then
    > copies the srcip and the sum of octets into a hash for each unique ipaddress.

    flow-report or flow-stat will do this a lot faster than a perl script...

    > At the end of every day(11:55pm) this script is stopped and the ipaddresses
    > along with the tally of octets used is written from the hash to a flat ascii
    > file.
    >
    > My problem is that I also have cflowd on the same box and I would like to
    > hear of opinions from people on the list of how to allow both cflowd and
    > flowtools to be able to use the netflow data exported from my router.

    flow-fanout. Send one copy to flow-capture and the other to cflowd.

    Just curious, what does cflowd do that flow-tools doesn't?

    > I've read of using flow-split that does not seem to be what I need to solve
    > my problem, please correct me if I am wrong, I have also thought of saving
    > the flows and exporting them to cflowd format using flow-export but then I
    > cannot parse the data in realtime as my script is currently doing.
    >
    > I would really appreciate it if I could get views and opinions on what I
    > should do in this situation. Any thing is appreciated.
    > --
    > In a rare moment of mental clarity,
    > I realized that I was insane. - Edson Manners
    > Academic Computing and Network Systems
    > Florida State University
    >
    > _______________________________________________
    > Cflowd mailing list
    > Cflowd@caida.org
    > http://login.caida.org/mailman/listinfo/cflowd

    _______________________________________________
    Cflowd mailing list
    Cflowd@caida.org
    http://login.caida.org/mailman/listinfo/cflowd



    This archive was generated by hypermail 2.1.4 : Mon Nov 25 2002 - 19:54:36 PST