Techniques for passive traffic capturing

Kevin Kadow kkadow+pottedmeatproduct at gmail.com
Tue Jun 24 03:00:06 UTC 2008


We started out with SPAN ports, then moved on to Netoptics taps.

Lately we've been using a combination of Cisco Netflow (from remote routers),
and native Argus flows (from local taps) where we need more details.

Flows are useful to answer "What happened X minutes/hours/days ago?",
and where you do not need/want to capture full packet bodies
(though with Argus you can choose whether to include payload data).

http://qosient.com/argus/




More information about the NANOG mailing list