[Cflowd] Cflowd and Catalyst5505

Tue, 28 May 2002 16:31:50 +0200

This is a multi-part message in MIME format.

------=_NextPart_000_04BF_01C20665.2B05F730
Content-Type: text/plain;
	charset="windows-1257"
Content-Transfer-Encoding: 8bit

dst IP only Multicast----- Original Message -----
From: Saravia, Jovanny - (Col)
To: 'Saulius Riauba'
Sent: Monday, May 27, 2002 4:09 PM
Subject: RE: [Cflowd] Cflowd and Catalyst5505

> Hi Saulius,
> I saw your e-mail wrote some days ago. I am interesting to know if is
> possible to measure flow in switches . What kind of answer did you have
> about this question ?
> This is possible, ? because I am sure that Catalyst 6500 could support
> flows but is because have the routing module.
> Rgds, Jovanny Saravia

Hi,

by that day I have found out, that Cisco switches (without any module)
support some NDE version, which however not serve for data collection using
Cflowd. For that purpose a switch needs to have a somekind module like RSM,
NFFC, RSFC (look below) which could make him to act at this aspect like
router. (Correct me please if I am not right.)

But I think there must be a possibility to collect NetFlow data from
switches without any module, but only by SNMP protocol (using MIB commands)
(not using Cflowd). For example I am using Cricket
(http://cricket.sourceforge.net/) for observing the network flows (but not
for data collection) from routers and from switches too, and not only from
Cisco. It’s a pity that Cricket not provides data collection or aggregation
like do Cflowd.

In Cisco WebPages
http://www.cisco.com/warp/public/cc/pd/si/casi/ca5000/prodlit/764_pb.htm we
read:

“With NetFlow Data Export (NDE), the performance management capabilities of
the Catalyst switches have now been extended to provide comprehensive
monitoring of all inter-subnet flows passing through the NFFC and the RSM. A
new NetFlow Data Export version 7 format is supported from the Catalyst 5000
with a NFFC when it is performing Layer 3 switching.”

About NDE and MLS Management:
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat5000/rel_5_2/layer3/n
de.htm#41001

“You can use NDE to monitor all IP Multilayer Switching (MLS) intersubnet
traffic through the NetFlow Feature Card (NFFC) or NFFC II and the Route
Switch Module (RSM), Route Switch Feature Card (RSFC), or externally
attached router. NDE complements the embedded Remote Monitoring (RMON)
capabilities on the switch that allow you to see all port traffic.”

Regards
Saulius Riauba

------=_NextPart_000_04BF_01C20665.2B05F730
Content-Type: text/html;
	charset="windows-1257"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>dst IP only Multicast</TITLE>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dwindows-1257">
<META content=3D"MSHTML 5.50.4522.1800" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV>----- Original Message ----- </DIV>
<DIV style=3D"FONT: 10pt arial">
<DIV style=3D"BACKGROUND: #e4e4e4; font-color: black"><B>From:</B> <A=20
title=3DJovanny.Saravia@attla.com =
href=3D"mailto:Jovanny.Saravia@attla.com">Saravia,=20
Jovanny - (Col)</A> </DIV>
<DIV><B>To:</B> <A title=3Dsaulius.riauba@sc.vu.lt=20
href=3D"mailto:saulius.riauba@sc.vu.lt">'Saulius Riauba'</A> </DIV>
<DIV><B>Sent:</B> Monday, May 27, 2002 4:09 PM</DIV>
<DIV><B>Subject:</B> RE: [Cflowd] Cflowd and Catalyst5505</DIV></DIV>
<DIV><FONT size=3D2></FONT><FONT size=3D2></FONT><FONT =
size=3D2></FONT><FONT=20
size=3D2></FONT><FONT size=3D2></FONT><FONT size=3D2></FONT><FONT =
size=3D2></FONT><FONT=20
size=3D2></FONT><FONT size=3D2></FONT><FONT size=3D2></FONT><FONT =
size=3D2></FONT><FONT=20
size=3D2></FONT><BR></DIV>
<DIV><FONT face=3D"Gill Sans MT" color=3D#0000ff><SPAN =
class=3D873250714-27052002>&gt;=20
Hi Saulius,</SPAN></FONT></DIV>
<DIV><FONT face=3D"Gill Sans MT" color=3D#0000ff><SPAN =
class=3D873250714-27052002>&gt;=20
I saw your e-mail wrote some days ago. I am interesting to know if is=20
</SPAN></FONT></DIV>
<DIV><FONT face=3D"Gill Sans MT" color=3D#0000ff><SPAN =
class=3D873250714-27052002>&gt;=20
possible to measure flow in switches . What kind of answer did you have=20
</SPAN></FONT></DIV>
<DIV><FONT face=3D"Gill Sans MT" color=3D#0000ff><SPAN =
class=3D873250714-27052002>&gt;=20
about this question ?</SPAN></FONT></DIV>
<DIV><FONT face=3D"Gill Sans MT" color=3D#0000ff><SPAN =
class=3D873250714-27052002>&gt;=20
This is possible, ? because I am sure that Catalyst 6500 could support=20
</SPAN></FONT></DIV>
<DIV><FONT face=3D"Gill Sans MT" color=3D#0000ff><SPAN =
class=3D873250714-27052002>&gt;=20
flows but is because have the routing module.</SPAN></FONT></DIV>
<DIV><FONT face=3D"Gill Sans MT" color=3D#0000ff><SPAN =
class=3D873250714-27052002>&gt;=20
Rgds,</SPAN></FONT><B>&nbsp;<FONT face=3D"Gill Sans MT" color=3D#000080=20
size=3D2>Jovanny Saravia</FONT></B> </DIV>
<DIV>
<P><SPAN class=3D764533423-21032002><SPAN =
class=3D764533423-21032002><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-fareast-font-family: =
'Times New Roman'; mso-ansi-language: EN-US; mso-fareast-language: =
EN-US; mso-bidi-language: AR-SA"><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial; mso-fareast-font-family: =
'Times New Roman'; mso-ansi-language: EN-US; mso-fareast-language: =
EN-US; mso-bidi-language: AR-SA"><SPAN=20
class=3D764533423-21032002><BR>Hi,<BR><BR>by that day I have found out, =
that Cisco=20
switches (without any module) support some NDE version, which however =
not serve=20
for data collection using Cflowd. For that purpose a switch needs to =
have a=20
somekind module like RSM, NFFC, RSFC (look below) which could make him =
to act at=20
this aspect like router. (Correct me please if I am not =
right.)<BR><BR>But I=20
think there must be a possibility to collect NetFlow data from switches =
without=20
any module, but only by SNMP protocol (using MIB commands) (not using =
Cflowd).=20
For example I am using Cricket (<A=20
href=3D"http://cricket.sourceforge.net/">http://cricket.sourceforge.net/<=
/A>) for=20
observing the network flows (but not for data collection) from routers =
and from=20
switches too, and not only from Cisco. It=92s a pity that Cricket not =
provides=20
data collection or aggregation like do Cflowd.<BR><BR><BR>In Cisco =
WebPages <A=20
href=3D"http://www.cisco.com/warp/public/cc/pd/si/casi/ca5000/prodlit/764=
_pb.htm">http://www.cisco.com/warp/public/cc/pd/si/casi/ca5000/prodlit/76=
4_pb.htm</A>=20
we read:
<P>=93With NetFlow Data Export (NDE), the performance management =
capabilities of=20
the Catalyst switches have now been extended to provide comprehensive =
monitoring=20
of all inter-subnet flows passing through the NFFC and the RSM. A new =
NetFlow=20
Data Export version 7 format is supported from the Catalyst 5000 with a =
NFFC=20
when it is performing Layer 3 switching.=94<BR><BR>About NDE and MLS =
Management:=20
<A=20
href=3D"http://www.cisco.com/univercd/cc/td/doc/product/lan/cat5000/rel_5=
_2/layer3/nde.htm">http://www.cisco.com/univercd/cc/td/doc/product/lan/ca=
t5000/rel_5_2/layer3/nde.htm#41001</A></P>
<P>=93You can use NDE to monitor all IP Multilayer Switching (MLS) =
intersubnet=20
traffic through the NetFlow Feature Card (NFFC) or NFFC II and the Route =
Switch=20
Module (RSM), Route Switch Feature Card (RSFC), or externally attached =
router.=20
NDE complements the embedded Remote Monitoring (RMON) capabilities on =
the switch=20
that allow you to see all port traffic.=94<BR><BR><BR>Regards<BR>Saulius =

Riauba</P></SPAN></DIV></SPAN></SPAN></SPAN></SPAN></BODY></HTML>

------=_NextPart_000_04BF_01C20665.2B05F730--