ISP
|
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
| 3750 | -------- | 3745 |
- - - - - - - - - - - - - - - - - span - - - - - - - - - - - - - - - -
|
Internal
I have an ISP facing 3750 switch running BGP. I want to collect Netflow statistics for this IP traffic.
I know that Netflow is not supported on the 3750 switch.
I know Lancope offer a Flow sensor for capturing data on a span port and turning this into netflow stats.
http://netflowninjas.typepad.com/blog/2009/12/stealthwatch-510-highlight-flowsensor-ae-features-and-benefits.html
I need a temporary solution and I have a spare 3745 router which supports netflow. I cant put this router
in series because it may be a bottleneck on a 20Mbps ISP connection.
Is there a way of feeding span traffic from the 3750 into a 3745 and seeing if it is able to generate the netflow stats.
I have tried this using only one interface and it does not work. Do I need to span both internal and external interfaces.
Does the IP traffic arriving at the 3745 have to cross two interfaces to generate neflow stats.
http://www.netflowanalysis.com/How%20does%20NetFlow%20Work.html
Any ideas ?