dedicated NetFlow (V5&V8) probe for OC-3, OC-12 and OC-48

Eddy Beier beier at
Tue Nov 27 09:22:02 UTC 2001

Dear all,

we've developed a NetFlow probe which processes about 1 Mpps (depends on
the CPUs) unsampled traffic. We called it FlowBox.

- based on rackmount PC (1U/2U)
- FreeBSD
- PoS NICs with deep HW support for probing 
- AS  list (RIPE format) loadable; so you don't need complete AS
information on the router; we can also integrate a BGP reader if this is
too static.
- optional sending to multiple Collectors
- optional passive (optical splitter) or active (lineloop/3R
regeneration/media adaption) probing
- optional V5 traffic reduction by a factor of about 1:10 by ignoring one
(the always changing) TCP port; (still 100% NetFlow compliant)
- tested by Cisco 
- tested with CAIDA's tools

First we built the box, now we try to build a business plan for; but we
failed up to now, 'cause there is no use for in europe (few number of high
speed lines, accounting infrastructure not yet developed etc)

Is there anybody who thinks, that the box has been a good idea?

Thanx in advance for any response (otherwise FlowBox will never touch the


Eddy Beier
CEO bina GmbH
Am Bruckweg 84
D-90499 Nuremberg

ps: for the historically interested ones:
we spinned off from the University of Erlangen with a complete Accounting
system in a single box. with this box e.g. BMW account their european
distributors (>800) and Allianz (europen insurance market leader)
their agents (>8000)
But it also had all problems of a complete accounting system in a single
box (e.g. full file system, lack of analysis recources) and it's been
So we focused on the de facto accounting interface NetFlow and on probing. 

More information about the NANOG mailing list