Netflow Nfsen Server Hardware

We are looking to purchase a new server for Netflow exports. This will mainly be used to evaluate our transit bandwidth for potential peering opportunities. A long data retention is not a high priority.

Our combined transit bandwidth is around 6 Gbps and increasing all the time.

Looking to get a sanity check on the server hardware required. We will be using Nfsen as the collector.

Would one of the below configurations be okay to handle such as task? If not, does anyone have any other recommendations.

Thanks in advance.

Tim

PowerEdge R610 -

    2x Intel E5540, 2.53GHz Quad Core Processor

    32GB RAM

    2x 300gb 10k 2.5" SAS HDD

    PERC6i RAID Controller

    iDRAC6 Enterprise

    Redundant Power Supply

    ReadyRails

PowerEdge R610 -

    2x Intel E5540, 2.53GHz Quad Core Processor

    64GB RAM

    6x 300gb 10k 2.5" SAS HDD

    PERC6i RAID Controller

    iDRAC6 Enterprise

    Redundant Power Supply

    ReadyRails

Since netflow processing is generally I/O bound, you may want to invest in
15K drives.

Joe

Would one of the below configurations be okay to handle such as task? If not, does anyone have any other recommendations.

Probably way overkill, but it's best to have excess capacity than not enough.

;>

I had suggested off-list that perhaps primary storage as SSD was a
better path, is there a reason to not do that? (with some larger
storage on spinning-media for historical storage/query).

I agree here with Christopher; A SSD to handle the high IOPS requirements
of real time data logging; combined with a scheduled transfer which can
"move" the stored data in a linear large block copy operation to ordinary
spindles, would be a cost effective hybrid solution.

This of course is assuming the application can handle this separation of
data; and I know nothing about Nfsen

To: Joe Loiacono/USA/CSC@CSC
Cc: Tim Calvin <tcalvin@tlsn.net>, "nanog@nanog.org" <nanog@nanog.org>
Date: 01/17/2013 11:01 AM
Subject: Re: Netflow Nfsen Server Hardware
Sent by: christopher.morrow@gmail.com

>
>> PowerEdge R610 -
>>
>> 2x Intel E5540, 2.53GHz Quad Core Processor
>>
>> 32GB RAM
>>
>> 2x 300gb 10k 2.5" SAS HDD
>
> Since netflow processing is generally I/O bound, you may want to

invest in

> 15K drives.

I had suggested off-list that perhaps primary storage as SSD was a
better path, is there a reason to not do that? (with some larger
storage on spinning-media for historical storage/query).

Nope, great suggestion. Just a cost consideration ...

Better IO controller(H700) with his NVcache will make a great job.
Especially if you have more SAS disks and some SSD. For nfdump is much
better a big SAS array build from six or more 900GB SAS HDD in RAID 5
(10k 2.5'' disks are good for this task).

Pavel

ah, ok... I figure that even if you were to put in 2 || 3 SSD drives
in the 200gb range, one per controller, you'd get maximum throughput
for a few days of data at not very much of a premium, then back up /
near-line store the data longer term on spinning 2tb or so disks.

That, and lots of storage for flow data. Even a small network can generate a lot of data.

jms