On Tue, Nov 16, 2010 at 12:33:37AM +0100, bas wrote:
Shouldn't there be a (**)
(**) Also Except for MX'es with trio chipsets. These can do inline-jflow that export to IPFIX (modified netflow v9)
All of the open source collector solutions I've tried that can handle v9 cannot handle IPFIX from the trio cards.
Richard; Do you have something that handles IPFIX?
Yes there's that too. I haven't actually gotten around to testing the Trio specific Netflow capabilities yet, but supposedly they only support IPFIX when using the "built in" sampling capabilities. If you want v9 you'll still need a Multiservice DPC, or you can always stick to classic RE-sampled v5/v8. IPFIX is effectively "netflow v10", it's largely based off of v9, but it's just different enough to be incompatible. Of course it's close enough that it shouldn't be THAT much work if you already have an existing v9 parser, but I don't know what software actually supports it today. The only flow collector implementation which I've spent any amount of time looking at besides the stuff I've written myself is pmacct, which IMHO shows great promise, but I don't believe it supports IPFIX yet. For my purposes I'd have been just as happy if everyone had standardized on sFlow (especially since I already wrote a parser for it :P), but alas it isn't meant to be. Some differences between v9 and IPFIX that googling turned up: http://www.plixer.com/blog/netflow/what-is-ipfix-vs-netflow-v9/ -- Richard A Steenbergen <ras@e-gerbil.net> http://www.e-gerbil.net/ras GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)