ARGUS_FLOW_STATUS_INTERVAL

[Peter Van Epp]

On Thu, Aug 17, 2006 at 01:47:02PM -0700, MN wrote:
> 
<snip>
> 
> On another unrelated note, we are interested in hearing the
> experience of those who are monitoring 10Gb connections.  Of
> special interest is aggregating multiple 10G feeds to eliminate
> issues caused by asymmetric routing.  Budget is a definite issue.
> We've looked briefly at Gigamon.
> 
> Thanks,
> - mike

	While I'm not at 10 gigs (at least yet :-)) I do have split commodity
CA*net4/I2 etc. link which has asymmetric routes. Ragator (racluster now I 
expect) deals with that mostly fine (I'd prefer it keeping one each MAC rather
than both from one link though :-)) to aggregate them after capture which 
reduces the requirements at the capture end. Although I haven't tried it, I 
believe you could capture one side of the link (rx or tx) on two capture 
machines (or 4 in the two link case) and ragator/racluster would happily 
aggregate them at a much much lower throughput later in to a single coherent
stream (cost however may be a little extreme at 4 10 g :-)). The thing to 
watch with aggregation (which we have done from a 10 gig to a 1 gig link to 
trouble shoot a bug :-)) is that if you exceed the speed of the monitor port 
you may blow up the entire switch (we did a gig to a 100 interface and forgot 
it and did exactly that on a production switch in the distant past :-)).

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada