Collecting NetFlow data on Linux
What do you do when looking at interface throughput isn't enough? Quite often, those SNMP throughput graphs will tell you that you have a problem, but won't take you to that next step – what protocol or which people are eating up all that bandwidth? Is this something I can fix with configuration, or do I need to work on policies to help control the video habits of the people in my organization, or do I truly need more bandwidth?
How can we get this information? It's not as easy as SNMP, but NetFlow collects all the information you might need to help be a "bandwidth detective." Let's discuss how this works, and what protocols are involved.
What is NetFlow and its "cousins" SFLOW, J-Flow, and IPFIX?
If you recall back in Chapter 3, Using Linux and Linux Tools for Network Diagnostics, and again in Chapter 11, Packet Capture and Analysis in Linux, where we discussed packet "tuples," this...
