no ip forged-source-address

Richard:

Just my $0.02,

May not be enough money. You present a solution to an unclearly defined problem. Never fear, the IETF has a packet sampling working group now, but one vendor has RFC3176 sFlow today (yesterday). I've got sFlow running on 1GbE links today and I'm planning on a 10GbE upgrade next year with sFlow support for the core. Same product I bought 2 years ago.

http://www.sflow.org/participants.htm

List is growing.

You can't make decisions about your network if you don't really know your network. An sFlow collector will give you accounting and monitoring to take any action you so desire to fix your problems in real time. Can't wait until this WG produces a standards based product though. IPFIX was started after sFlow. IPFIX is short of the mark for L2 networks.

A very happy sFlow (www.ietf.org/rfc/rfc3176.txt) user...

Bobby