Techniques for passive traffic capturing
kkadow+pottedmeatproduct at gmail.com
Mon Jun 23 22:00:06 CDT 2008
We started out with SPAN ports, then moved on to Netoptics taps.
Lately we've been using a combination of Cisco Netflow (from remote routers),
and native Argus flows (from local taps) where we need more details.
Flows are useful to answer "What happened X minutes/hours/days ago?",
and where you do not need/want to capture full packet bodies
(though with Argus you can choose whether to include payload data).
More information about the NANOG