Hi folks.
I just posted a new version of cflowd at:
http://engr.ans.net/cflowd/index.html
The new version (1.2-alpha) has a rewritten raw flow module using
memory-mapped I/O. For those of you that have used it, you can now turn
on raw flow logging and not thrash your machine with flow->disk I/O.
The new version also has a bug fix for remote client connections; this
is an old fix I never got around to posting.
The code is still based on some old beta Cisco bits which include AS
numbers in flow-export. I don't know the status of getting that code
into ELC, but I'll try to find out (Paul? Dave? Anyone?).
In about 5 minutes, I'll be deploying this new code on a few ANS
machines and leaving raw flow logging turned on. Who knows, maybe I'll
have a silly SYN flood story for San Francisco.
I do have about 3 month's worth of AS matrix data (5-minute polling
intervals) on-line and have a lot of charts. I'll put up some of my
slides at the site above soon.
Daniel