Date: Thu, 9 Sep 2004 00:24:47 +0400 From: Gleb Smirnoff <glebius@freebsd.org> To: Julian Elischer <julian@elischer.org> Cc: net@freebsd.org Subject: Re: [TEST/REVIEW] Netflow implementation Message-ID: <20040908202447.GA5179@cell.sick.ru> In-Reply-To: <413F4BBE.1020304@elischer.org> References: <20040905121111.GA78276@cell.sick.ru> <20040908103529.V97761@murphy.imp.ch> <20040908085607.GG597@cell.sick.ru> <413F4BBE.1020304@elischer.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Sep 08, 2004 at 11:13:18AM -0700, Julian Elischer wrote: J> >This is working solution, but not correct. :) J> >To catch both directions you should feed ng_netflow with incoming traffic J> >from all interfaces. J> > J> J> using 'tee' means you are duplicating all packets. J> shouldn't you do collection "inline? or does this NEED to have copies of J> the packets? This is in my TODO and TOSEE list. I'm not yet sure that this would be better. There are some advantages in current state: packets are processed with no delay, and a copy is queued for netflow processing. In case of multiple interfaces attached to netflow node we can serve them simultaneosly, without waiting for lock on single netflow node. A good solution would be to send only IP and TCP header towards netflow node. Is there a standard way to do this? -- Totus tuus, Glebius. GLEBIUS-RIPN GLEB-RIPE
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040908202447.GA5179>