Why don source and destination IP addresses that are present in the raw flows get passed on by cfdcollect to the arts++ files?
I assume that you mean host IP addresses, in which case that’s correct. Host-level granularity is not carried through the system (doesn’t go to cfdcollect, doesn’t get written to the arts++ file). In other words, there is no ‘host matrix’ data type. Keeping data at such a granularity is very resource-intensive if it’s flooded through the whole system. It is also often just not useful for what cflowd was designed to do: collect data for capacity planning and engineering. The net matrix is as granular as we get at this point, and is usually more than granular enough for any capacity planning activities. It contains network/mask ==> network/mask traffic data. You need to use flow-export version 5 on your router, and enable ‘netmatrix’ collection in cflowd.conf. The cflowd system will store the net matrix information. Note that it’s somewhat common to see /32 networks (host addresses) in the net matrix, but usually not enough to cause it to explode into a host matrix. Multicast destination
Related Questions
- Why don source and destination IP addresses that are present in the raw flows get passed on by cfdcollect to the arts++ files?
- Does the gateway (router) change the source and destination IP addresses of the IP packets passing by?
- Can Upcopy work with a text list of source files to copy to a destination?
