[Cflowd] Re: [flow-tools] Typical Hardware

From: Mark Fullmer (maf@eng.oar.net)
Date: Wed Feb 12 2003 - 11:08:15 PST

  • Next message: Monica: "[Cflowd] Lovers meet here 7560a-5"

    On Abilene we're using Intel SR2200's with 1.2GHz P3's and SCSI drives
    as collectors.

    Each of the 11 POP's has a dedicated collector which runs flow-fanout
    and flow-capture for a Juniper T640, and in some cases a Cisco GSR. There's
    a few M5's in the mix too. flow-fanout is used to replicate the feeds to a
    local flow-capture instance and remotely located Asta and Arbor collectors.

    The flow files are collected every few hours with rsync to a 2GHz Xeon
    based server with a few terabytes of storage built with 3ware
    controllers and 16 160GB IDE drives.

    The servers are all running stock FreeBSD with a few tweaks to the
    socket and TCP buffers:

    kern.ipc.maxsockbuf=20480000
    net.inet.tcp.sendspace=1024768
    net.inet.tcp.recvspace=1024768

    flow-capture and flow-fanout < 0.64 would request 224K bytes of socket
    buffer space and work down until the OS would grant the request. 0.64
    starts at 4MB and works down. Most OS's will not grant anything > 224K
    without OS tweaks like above. Without this change the servers can not
    support the 3x replication and store/compress the highly bursty
    NetFlow (cflowd in Juniper talk) exports without packet loss.

    flow-capture and flow-fanout also run under rtprio which gives them
    "real time" priority over other processes. Without rtprio even logging
    into the box when it is busy can cause loss of flows.

    I'm looking at Intel SR1300's with dual 80GB IDE drives and a built in
    Promise IDE RAID controller for a new deployment. My one gripe with
    these is they don't hava a DC supply option available yet. Both the 2200's
    and 1300's have a BIOS that is accessable from the serial port which makes
    remote management easier.

    mark

    On Mon, Feb 10, 2003 at 04:01:31PM -0500, Edson Manners wrote:
    > I would like to do an informal survey of the type of hardware that people on
    > this list are using for running flowtools and or cflowd.
    >
    > We are running both on separate RH Linux computers. Handling about 120Mb of
    > traffic.
    >
    > Cflowd flow-tools
    > Dual GHz Pentium Dual GHz Pentium
    > 1GB RAM 512 MB RAM
    > 70MB free RAM 11MB free RAM
    > 30GB HW RAID5 SCSI 30 GB HW RAID5 SCSI
    > 80% idle cpu 60% idle cpu
    >
    >
    > I would be interested in any comments suggestions or faults that anyone has
    > with this setup.
    > --
    > Education's purpose is to replace an empty
    > mind with an open one. - Edson Manners
    > Academic Computing and Network Systems
    > Florida State University
    >
    > _______________________________________________
    > flow-tools@splintered.net
    > http://www.splintered.net/sw/flow-tools

    _______________________________________________
    Cflowd mailing list
    Cflowd@caida.org
    http://login.caida.org/mailman/listinfo/cflowd



    This archive was generated by hypermail 2.1.4 : Wed Feb 12 2003 - 11:24:04 PST