RES: RES: [Flow-tools] Flow in samples

[Neil McKee]

A list of tools supporting sFlow is maintained on the sFlow  
technology website http://www.sflow.org under Products>sFlow Collectors.

Some free,  some not so free.
Many of them support NetFlow too.

One of the free ones, sflowtool,  can be used to convert sFlow to  
sampled-netflow v5 e.g. for feeding into flow-tools (or to pcap  
format for feeding into tethereal, tcpdump or snort).  Of course, in  
extracting NetFlow v5 you are throwing some of the useful sFlow  
information away,  so I would encourage you to check out some of the  
specialized sFlow applications too.

neil



On Oct 31, 2007, at 10:39 AM, Caio Brentano wrote:

> So, does flow-tools support sFlow? :-)
>
> -----Mensagem original-----
> De: bill fumerola [mailto:billf at mu.org]
> Enviada em: segunda-feira, 29 de outubro de 2007 19:35
> Para: Caio Brentano
> Cc: flow-tools at list.splintered.net
> Assunto: Re: RES: [Flow-tools] Flow in samples
>
> On Mon, Oct 29, 2007 at 05:56:01PM -0200, Caio Brentano wrote:
>> Changing the question: Can I analyse sFlow and Netflow together?
>
> you can analyze grapefruit and netflow together if you have the  
> right data.
> did you mean "do flow-tools support sFlow"?
>
> sFlow != "sampled flow" != juniper netflow
> sFlow == different specification than juniper/cisco netflow.
>
>> I mean flow-capture is set for Netflow V5. One process collect from a
>> Netflow from a Cisco router, other process collect from a Juniper.  
>> I have
> to
>> analyse theses flow files, but Juniper sends sampling flows! What  
>> I have
> to
>> do about Juniper flows?
>
> you just asked the same question with different words. that's changing
> the wording and not the question.
>
> also, not all cisco routers export non-sampled flows.
>
> -- bill
>
> E-mail classificado pelo Identificador de Spam Inteligente Terra.
> Para alterar a categoria classificada, visite
> http://mail.terra.com.br/cgi-bin/imail.cgi? 
> +_u=caio.b&_l=1,1193693732.550985
> .19209.fomboni.hst.terra.com.br,2010,Des15,Des15
>
> Esta mensagem foi verificada pelo E-mail Protegido Terra.
> Scan engine: McAfee VirusScan / Atualizado em 26/10/2007 / Versco:
> 5.1.00/5150
> Proteja o seu e-mail Terra: http://mail.terra.com.br/
>
> _______________________________________________
> Flow-tools mailing list
> flow-tools at splintered.net
> http://mailman.splintered.net/mailman/listinfo/flow-tools