[netflow-tools] Up to which amount of traffic does softflowd work properly?

[Andreas Brillisauer -- Hetzner Online AG]

Hello,

I would like to use softflowd for traffic accounting on a Gbit
interface. I already did some testing. I have a AMD Opteron machine with
2 GB RAM that runs Debian Sarge. The machine gets the traffic via a
mirrored port. At 270 Mbit (50,000 packets/sec) softflowd needs 80 % of
the CPU.

Does anyone use softflowd with more Mbit? Are there any possiblities for
a higher performance. I already have a patch for ignoring the ports --
so softflowd will open less flows. This is one possibility to improve
the performace. Are there any other ways to increase performance?

If softflowd isn't high-performance enough to handle a Gbit interface on
the abovementioned hardware, are there other tools that are designed for
such an amount of traffic? What are your experiences?

Greetings,
Andreas