Date: Wed, 08 Sep 2004 15:37:06 -0700 From: Julian Elischer <julian@elischer.org> To: Gleb Smirnoff <glebius@freebsd.org> Cc: net@freebsd.org Subject: Re: [TEST/REVIEW] Netflow implementation Message-ID: <413F8992.1000900@elischer.org> In-Reply-To: <20040908202447.GA5179@cell.sick.ru> References: <20040905121111.GA78276@cell.sick.ru> <20040908103529.V97761@murphy.imp.ch> <20040908085607.GG597@cell.sick.ru> <413F4BBE.1020304@elischer.org> <20040908202447.GA5179@cell.sick.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
Gleb Smirnoff wrote: >On Wed, Sep 08, 2004 at 11:13:18AM -0700, Julian Elischer wrote: >J> >This is working solution, but not correct. :) >J> >To catch both directions you should feed ng_netflow with incoming traffic >J> >from all interfaces. >J> > >J> >J> using 'tee' means you are duplicating all packets. >J> shouldn't you do collection "inline? or does this NEED to have copies of >J> the packets? > >This is in my TODO and TOSEE list. I'm not yet sure that this would be better. >There are some advantages in current state: packets are processed with no delay, >and a copy is queued for netflow processing. In case of multiple interfaces >attached to netflow node we can serve them simultaneosly, without waiting for >lock on single netflow node. > >A good solution would be to send only IP and TCP header towards netflow node. >Is there a standard way to do this? > > that would be the ng_iphdr node that you are thining about writing? :-) > > >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?413F8992.1000900>