[TEST/REVIEW] Netflow implementation

[Gleb Smirnoff]

On Wed, Sep 08, 2004 at 11:13:18AM -0700, Julian Elischer wrote:
J> >This is working solution, but not correct. :)
J> >To catch both directions you should feed ng_netflow with incoming traffic
J> >from all interfaces.
J> >
J> 
J> using 'tee' means you are duplicating all packets.
J> shouldn't you do collection "inline? or does this NEED to have copies of 
J> the packets?

This is in my TODO and TOSEE list. I'm not yet sure that this would be better.
There are some advantages in current state: packets are processed with no delay,
and a copy is queued for netflow processing. In case of multiple interfaces
attached to netflow node we can serve them simultaneosly, without waiting for
lock on single netflow node.

A good solution would be to send only IP and TCP header towards netflow node.
Is there a standard way to do this?


-- 
Totus tuus, Glebius.
GLEBIUS-RIPN GLEB-RIPE