IPFIX flows

[Carter Bullard]

Hey Joel,
Sorry Vmware messed you up.  You can run argus in those VMs or against the hypervisor, or below in the native OS, and get past that ????

If it was a simple mod to our Netflow V9 support then I would say sure, but with even the simplest things changing in IPFIX at what sems to be on a monthly basis, I believe it would be a huge drag on our  limited Argus resources.  Just as an example, they have full RFCs for just dealing with two additional experimental TCP control bits, and the change, for them, is non-trivial, which makesnit non-trivial for everybody.

But if we get some more demand, or money, then sure.... But if someone wants to take a shot at it, the Netflow V9 code would be a good start !!!

Carter

On Sep 10, 2013, at 4:46 PM, Joel Bergstein <jbergstein at riscnetworks.com> wrote:

> All,
>  
> I have been looking at collecting netflow data from vSphere.  I’ve found that starting with 5.1, VMware no longer supports netflow v5 and will only send IPFIX packets.
>  
> The argus site requests an email from those interested in IPFIX data, thus this email.
>  
> Has there been much expressed interest in IPFIX?  What is the likelihood of this development moving forward?
>  
> Thanks,
> Joel Bergstein
>  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130911/78fb571d/attachment.html>