<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<TITLE>Message</TITLE>
<META content="MSHTML 6.00.2800.1276" name=GENERATOR>
<STYLE>@page Section1 {size: 8.5in 11.0in; margin: 1.0in 1.25in 1.0in 1.25in; }
P.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
LI.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
DIV.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
A:link {
COLOR: blue; TEXT-DECORATION: underline
}
SPAN.MsoHyperlink {
COLOR: blue; TEXT-DECORATION: underline
}
A:visited {
COLOR: purple; TEXT-DECORATION: underline
}
SPAN.MsoHyperlinkFollowed {
COLOR: purple; TEXT-DECORATION: underline
}
SPAN.EmailStyle17 {
COLOR: windowtext; FONT-FAMILY: Arial
}
DIV.Section1 {
page: Section1
}
</STYLE>
</HEAD>
<BODY lang=EN-US vLink=purple link=blue>
<DIV><SPAN class=464410922-26032004><FONT face=Arial color=#0000ff size=2>Have
you used flow-tools?</FONT></SPAN></DIV>
<DIV><SPAN class=464410922-26032004><FONT face=Arial color=#0000ff size=2><A
href="http://www.splintered.net/sw/">http://www.splintered.net/sw/</A></FONT></SPAN></DIV>
<DIV><SPAN class=464410922-26032004><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=464410922-26032004><FONT face=Arial color=#0000ff size=2>You
can configure it to filter on pretty much any parameter that's
contained</FONT></SPAN></DIV>
<DIV><SPAN class=464410922-26032004><FONT face=Arial color=#0000ff size=2>in the
flow-export packets. Then you send it to the report tool that's
included</FONT></SPAN></DIV>
<DIV><SPAN class=464410922-26032004><FONT face=Arial color=#0000ff size=2>in the
flow-tools suite, after which you can put it through a perl script or
</FONT></SPAN></DIV>
<DIV><SPAN class=464410922-26032004><FONT face=Arial color=#0000ff size=2>a
graphing tool or whatever in near real-time.</FONT></SPAN></DIV>
<DIV><SPAN class=464410922-26032004></SPAN> </DIV>
<BLOCKQUOTE dir=ltr
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
<DIV></DIV>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left><FONT
face=Tahoma size=2>-----Original Message-----<BR><B>From:</B>
owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] <B>On Behalf Of </B>Drew
Weaver<BR><B>Sent:</B> Friday, March 26, 2004 3:39 PM<BR><B>To:</B>
nanog@merit.edu<BR><B>Subject:</B> Sorry if this discussion has been had
recently but<BR><BR></FONT></DIV>
<DIV class=Section1>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">
I know there is a way to do this, but what is the absolute Defacto best method
of tracking flows from Cisco/Juniper routers? I know there is some freeware
available such as cflowd but we really need something that will alert us to
trouble before it becomes a problem. We don't mind buying an appliance to do
this, and it doesn't have to be freeware software, we just want something that
will work.</SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Thanks,</SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">-Drew</SPAN></FONT></P></DIV></BLOCKQUOTE></BODY></HTML>