Re: NetFlow export

[Jakob Oestergaard]

On Thu, Mar 13, 2003 at 12:57:08PM +0100, Florian Weimer wrote:
> Jakob Oestergaard <[e-mail]> writes:
> 
> > On Thu, Mar 13, 2003 at 12:07:00PM +0100, Florian Weimer wrote:
> >> Are there any patches which implement kernel-based NetFlow data
> >> export?
> >
> > Netramet works very well - it's userspace (and very flexible indeed).
> 
> According to the documentation, it can receive NetFlow data and
> process it, but it cannot generate such data.

I never used it to receive netflow data.

I used netramet to generate flow information on a linux-based backbone
router, and to periodically move the flow information to another node
for batch processing/analysis.

I used the netramet tools to extract that information from the netramet
"meter" (the flow measurement daemon running on the router), for storage
on the remote accounting/processing machine. Some custom Perl scripts
process the flow information thereafter.

You asked for netflow data export. Netramet can give you something
similar to netflow (I never used netflow, but from what I hear, netramet
is similar only more flexible).

> 
> > No need to clutter the kernel with an SNMP stack too, if you ask me.
> 
> NetFlow doesn't use a complicated packet format and is not based on
> SNMP.  You can parse version 5 or 7 packets in 10 lines of Perl code,
> using a few calls to "unpack".

With 10 lines of Perl you could do full ASN-1   ;)

Netramet uses SNMP for the data transport - and I am very much surprised
if Cisco does not use SNMP - but again, I did not use netflow so I
wouldn't know.

In any case, to the "end user", it's as simple as calling a tool saying
"get me my data" - whether it's SNMP based or not.

Point being; if what you want is flow information from a Linux router,
excellent user space software (both "meter" and retrieval/filtering
tools) already exist for that.

If you want something else, then I have completely misread your mails.
Please elaborate, in that case  :)

-- 
................................................................
:   [e-mail]   : And I see the elder races,         :
:.........................: putrid forms of man                :
:   Jakob Østergaard      : See him rise and claim the earth,  :
:        OZ9ABN           : his downfall is at hand.           :
:.........................:............{Konkhra}...............: