Multi-collector Netflow/etc

Wed Jul 17 21:07:09 UTC 2002

There are lots of interesting tools to collect and analyze
network traffic information from protocols like Netflow,
sFlow, LFAP, etc. Few of the collectors/analyzers share
common data repositories, so one sets up a machine for each
with its own export from each router.

How are others handling this problem, particularly after
hitting the limit of one or two export flows supported by
most routers today?

Apparently there are a number of packet reflectors (usually
running on a Unix machine) that work in theory, how do these
work in actual practice, what kind of performance and 
reliability to they have, and which work well for traffic 
collection?

Has anyone tried using multicast or broadcast addresses or
other tricks (shared IP address or MAC address on multiple
machines) to share a single accounting stream across
multiple collectors?

Any other methods that are working for scaling multiple 
collectors without exceeding router limitations or burdening 
routers unnecessarily?

Pete.