[netflow-tools] Softflowd & flow-tools on multiple interfaces.
Sean Cody
sean at tinfoilhat.ca
Tue Jul 14 02:04:03 EST 2009
I've deployed both softflowd and flow-tools to devices that I can't
easily add a mirror port to.
So I've got around 5 sensors per site (softflowd on 3 mirror
interfaces and on 2 devices directly) and 1 collector and am saving
them in completely different flow-tools log sets. A bit of reading
lends me to the idea of using the interface field in the flow records
to record which device the flow came from (and have online 1 set of
flow logs).
Is this possible or should I continue using the 1 softflowd per flow-
capture setup?
As well is there an easy way to tell if softflowd is missing flows
(ala tcpdump discards)?
--
Sean
More information about the netflow-tools
mailing list