From: Mark Fullmer (maf@eng.oar.net)
Date: Wed Feb 12 2003 - 11:08:15 PST
On Abilene we're using Intel SR2200's with 1.2GHz P3's and SCSI drives
as collectors.
Each of the 11 POP's has a dedicated collector which runs flow-fanout
and flow-capture for a Juniper T640, and in some cases a Cisco GSR. There's
a few M5's in the mix too. flow-fanout is used to replicate the feeds to a
local flow-capture instance and remotely located Asta and Arbor collectors.
The flow files are collected every few hours with rsync to a 2GHz Xeon
based server with a few terabytes of storage built with 3ware
controllers and 16 160GB IDE drives.
The servers are all running stock FreeBSD with a few tweaks to the
socket and TCP buffers:
kern.ipc.maxsockbuf=20480000
net.inet.tcp.sendspace=1024768
net.inet.tcp.recvspace=1024768
flow-capture and flow-fanout < 0.64 would request 224K bytes of socket
buffer space and work down until the OS would grant the request. 0.64
starts at 4MB and works down. Most OS's will not grant anything > 224K
without OS tweaks like above. Without this change the servers can not
support the 3x replication and store/compress the highly bursty
NetFlow (cflowd in Juniper talk) exports without packet loss.
flow-capture and flow-fanout also run under rtprio which gives them
"real time" priority over other processes. Without rtprio even logging
into the box when it is busy can cause loss of flows.
I'm looking at Intel SR1300's with dual 80GB IDE drives and a built in
Promise IDE RAID controller for a new deployment. My one gripe with
these is they don't hava a DC supply option available yet. Both the 2200's
and 1300's have a BIOS that is accessable from the serial port which makes
remote management easier.
mark
On Mon, Feb 10, 2003 at 04:01:31PM -0500, Edson Manners wrote:
> I would like to do an informal survey of the type of hardware that people on
> this list are using for running flowtools and or cflowd.
>
> We are running both on separate RH Linux computers. Handling about 120Mb of
> traffic.
>
> Cflowd flow-tools
> Dual GHz Pentium Dual GHz Pentium
> 1GB RAM 512 MB RAM
> 70MB free RAM 11MB free RAM
> 30GB HW RAID5 SCSI 30 GB HW RAID5 SCSI
> 80% idle cpu 60% idle cpu
>
>
> I would be interested in any comments suggestions or faults that anyone has
> with this setup.
> --
> Education's purpose is to replace an empty
> mind with an open one. - Edson Manners
> Academic Computing and Network Systems
> Florida State University
>
> _______________________________________________
> flow-tools@splintered.net
> http://www.splintered.net/sw/flow-tools
_______________________________________________
Cflowd mailing list
Cflowd@caida.org
http://login.caida.org/mailman/listinfo/cflowd
This archive was generated by hypermail 2.1.4 : Wed Feb 12 2003 - 11:24:04 PST