[TEST/REVIEW] Netflow implementation

[Julian Elischer]

Gleb Smirnoff wrote:

>On Wed, Sep 08, 2004 at 11:13:18AM -0700, Julian Elischer wrote:
>J> >This is working solution, but not correct. :)
>J> >To catch both directions you should feed ng_netflow with incoming traffic
>J> >from all interfaces.
>J> >
>J> 
>J> using 'tee' means you are duplicating all packets.
>J> shouldn't you do collection "inline? or does this NEED to have copies of 
>J> the packets?
>
>This is in my TODO and TOSEE list. I'm not yet sure that this would be better.
>There are some advantages in current state: packets are processed with no delay,
>and a copy is queued for netflow processing. In case of multiple interfaces
>attached to netflow node we can serve them simultaneosly, without waiting for
>lock on single netflow node.
>
>A good solution would be to send only IP and TCP header towards netflow node.
>Is there a standard way to do this?
>  
>

that would be the ng_iphdr node that you are thining about writing?

:-)

>
>  
>