ntop for Linux 4.1

Many people use PF_RING just as a ???*Nsbetter???*N? libpcap. PF_RING is much more than that, as it can significantly simplify the design of network monitoring applications as well better exploit modern multi-core architectures and network adapters.<br /><br /><br /><br /> * he NetFlow-lite capability on Cisco Catalyst 4948E aims at providing traffic visibility into data center access layer, including server-to-server user-to-server activities.<br /> * With the help of nProbe, netflow-lite can be analyzed and supported by any netflow collector that understand version5, 9 or IPFIX.<br /> * Netflow-lite solution can be designed from a tiered approach for large scale data center: by deploying an nProbe per zone to summarize NetFlow-lite data within the zone, it reduces the amount of bandwidth overhead and allows data from multiple zones to be analyzed and gathered by a centralized netflow collector.<br /> * nProbe & NetFlow-lite supports NetFlow version 9 and IPFIX.<br /> * nProbe act as a collector to netflow-lite switches and as a probe to end collector. It works seamlessly with existing, already deployed NetFlow collector as well as allowing a wide choice of NetFlow collector for new deployment.<br /><br />NetFlow-Lite and nProbe<br /><br />As stated above, nProbe is the first application to support NFLite. You might wonder what are the challenges behind this work. I can list some:<br /><br /> * NFLite collector does not simply receives flows and dumps them on a DB (as most collectors do). It must also implement the flow cache, that is a typical activity that a netflow probe does, and that is missing in collectors (they usually filter and aggregate flows, but nothing more than that).<br /> * NFLite flows contain packet samples, that are basically packets seen on switch ports, along with some metadata information such as the port on which such packet has been seen. This means that those packets need to be decoded (i.e. packet parsing) and consolidated into the flow cache. Dumping them on disk in raw format (as NetFlow collectors usually do) is useless as you can???*a*?t do much with them.<br /> * Depending on the number of NFLite-aware switches, traffic and sampling rate, that send traffic towards the same nProbe, the amount of packets can be as high as 1-2 million flows/sec. Most NetFlow collectors can handle a sustained collection speed of a few tenth/hundred flows/sec, that is not adequate for providing accurate network visibility.

Requirements:	No special requirements
Platforms:	*nix, Linux
Keyword:	Applications,  Architectures,  As It,  As Well,  Design,  Exploit,  Exploit Modern,  Is Much,  It Can,  Just As,  Libpcap,  Network,  People,  Ring,  Significantly,  Significantly Simplify,  Simplify Design
Users rating:	0/10