Re: Netflow Type 7 (was RE: bw usage?)

["Dana Hudes" <dhudes () hudes org>]

Usually you don't want type 7, you want type 5. Let cflowd et al have the full data. Type 7 the router has done 
aggregation for you. Good for reducing
overall data rate to the flow capture system but bad for seeing what's going on in your network.

----- Original Message ----- 
From: <rdobbins () netmore net>
To: <nanog () merit edu>
Sent: Wednesday, July 26, 2000 12:11 PM
Subject: Netflow Type 7 (was RE: bw usage?)


> Does anyone know of a tool like Cflowd which will capture Netflow Type 7
> stats?  The only one I know of is the commercial product from Cisco; any
> advice would be greatly appreciated.
>
> -----------------------------------------------------------
> Roland Dobbins <rdobbins () netmore net> // 818.535.5024 voice
>  
>
> -----Original Message-----
> From: Alex [mailto:alex () nac net]
> Sent: Wednesday, July 26, 2000 8:23 AM
> To: David M. Ramsey
> Cc: nanog () merit edu
> Subject: Re: bw usage?
>
>
>
>
>
>
> On Wed, 26 Jul 2000, David M. Ramsey wrote:
>
> > For now I've cobbled together some crude software to regularly 
> > read SNMP port byte in/out counters from our switches, stashing 
> > the deltas in a DB for later reporting/analysis.
>
> We do about the same thing, but we store absolute byte counts, relative
> byte counts from the last measurement, and figure the kb/s; we also store
> AdminStatus and OperStatus for SLA purposes. 
>
>
> > I'm concerned that the data is misleading, though, in that it will
> > include LAN broadcast traffic.  Also, customers end up paying 
> > for other bandwidth that they did not want or induce, like network 
> > scans, etc. (tough luck?).
>
> Exactly, tough. If they use the bandwidth, then they should pay for the
> bandwidth.
>
>
> > We've considered implementing unique customer VLANS to separate
> > customer broadcast domains, but it seems like that'd be a pain,
> > would eat up IP addresses, and possibly tax our routers with all of
> > the ISL/VLAN stuff?
>
> We do that; it's unwise to have everyone on the same VLAN, as some others
> have demonstrated.