Re: NetFlow
- Date: Mon, 03 Dec 2001 08:42:21 -0800 (PST)
On Fri, 30 Nov 2001, Keith Godber wrote:
> At Ripe 40 in Prague the subject of NetFlow came up - and if this was a
> subject that the TT working group should look at.
>
> For my part I would say the answer is "Yes." This is traffic
> measurement and produces useful real world data.
We analyse netflow data and I agree it has its uses. I look at the graphs
from time-to-time to see changes in traffic patterns. I'm told our
cyber-security use it too. Other people use it to look for changes
indicative of a problem somewhere in the WAN that is�disrupting traffic.
I did a quick survey and there are 2 features that we'd like to see
improved:
1/ better handling of fragmented packets
2/ better timestamping (to give time-in-flight data)
What would the TT working group look at ? Are you thinking of building
netflow analysis tools into our RIPE box ?
--------------------------------------------------------------------------
Dr. Warren Matthews If ease of use was the highest goal,
Principal Network Specialist we'd all be driving golf carts.
Stanford Linear Accelerator Center. - Larry Wall.
On Fri, 30 Nov 2001, Keith Godber wrote:
> At Ripe 40 in Prague the subject of NetFlow came up - and if this was a
> subject that the TT working group should look at.
>
> For my part I would say the answer is "Yes." This is traffic measurement
> and produces useful real world data.
>
> There's two reason's for me sending this posting:
>
> a) Would anyone be willing to make a presentation at Ripe 41 regarding
> use of NetFlow?
>
> Maybe you have a couple of years of data and want to show us some trends,
> some abnormalities.
> Maybe you have linked NetFlow data with routing data and have a tool to
> predict the flow of traffic should a certain peer and peering point fail.
> etc...
>
> b) Get a thread running.
>
> Tell the world about your NetFlow woes.
> That NetFlow is the font of all knowledge in your organisation.
> That you tried it, and didn't like it.
>
>
> There's some ideas. Over to you...
>
>
>
> Keith
>
