I have been looking around for a while now, for a piece of software that
can sit on a *nix box, and simply export netflows from a promiscuous mode
media adapter.
For instance; I've become used to using the ip flow-aggregation stuff
(specificall for AS), as follows:
ip flow-aggregation cache as
export destination x.x.x.y 4444
enabled
Problem being tho, that on the 6509/MSFC2/PFC platform, to use this, you
have to raise the traffic flow out of hardware-switched PFC to MSFC
software switching/routing.
What I'd like to do is take a unix box, with a gig-e or whatnot interface,
mirror traffic to it, and let it generate the flow's to be collected by
another machine.
Anyone got some pointers, or insight? How are others doing AS flows?
-- Alex Rubenstein, AR97, K2AHR, alex@nac.net, latency, Al Reuben --
-- Net Access Corporation, 800-NET-ME-36, http://www.nac.net --