[Nfdump-discuss] Netflow Generation with SPAN+softflowd/nProbe

[Ryan H. <har...@uc...>]

All,

We’re looking at moving away from generating NetFlow directly on our networking devices to using SPAN ports to something like Arista’s TapAgg solution and ultimately to linux systems running softflowd or nProbe. Naturally, our security group is concerned about this solution and it’s ability to generate NetFlow records at line-rate.

Is anyone doing this? If so, can you answer a few questions below?

1) How much traffic are you consuming on average?
2) How many linux systems are you using? How many Cores? At what load?
3) Are you seeing any drops or missed packets? How are you verifying this?

We use nfsen/nfdump for collection along with commercial products and I hope that a few of you in this community are running a similar configurations.

Thanks.

/Ryan

Ryan Harden
Research and Advanced Networking Architect
University of Chicago - ASN160
P: 773.834.5441