[netflow-tools] Softflowd & flow-tools on multiple interfaces.

Sean Cody sean at tinfoilhat.ca
Tue Jul 14 02:04:03 EST 2009


I've deployed both softflowd and flow-tools to devices that I can't  
easily add a mirror port to.
So I've got around 5 sensors per site (softflowd on 3 mirror  
interfaces and on 2 devices directly) and 1 collector and am saving  
them in completely different flow-tools log sets.  A bit of reading  
lends me to the idea of using the interface field in the flow records  
to record which device the flow came from (and have online 1 set of  
flow logs).

Is this possible or should I continue using the 1 softflowd per flow- 
capture setup?

As well is there an easy way to tell if softflowd is missing flows  
(ala tcpdump discards)?

-- 
Sean




More information about the netflow-tools mailing list