[flow-tools] capturing flows to locations based on source

[Mark Fullmer]

Multiple instances of flow-capture is the easiest way to do
this.  Adding IP alias addresses to the collector server
and binding an instance of flow-capture to each IP for
each exporter is an alternative to multiple UDP ports.

Adding functionality to flow-capture to work with multiple
files is a little more work than just appending the IP
to the pathname.  Each exporter may have different attributes
(disk space expiration policy, AS substitution, compression, etc)
which can't easly be done without adding a configuration file to
flow-capture.  It's something I've thought about adding but right
now it's very low on the todo list.

mark

On Mon, Jun 03, 2002 at 02:49:40PM -0700, Changeling wrote:
> I saw a couple messages a couple months back about
> this, but I dont believe there was ever a solution
> presented.
> 
> Using flow-capture, I'm looking to store the flows in
> seperate directories based on the exporter.  For
> instance, if I receive a flow from 10.0.0.1, I want it
> to go under a 10.0.0.1 folder... likewise for 10.0.0.2
> and so on.
> 
> I'm aware that I could run multiple instances of
> flow-capture on different ports, but I would prefer to
> have a single instance running on a single port.  This
> makes the solution much more managable since each
> exporter does not need to send to a different port.
> 
> I wanted to check here and see if this is either
> already possible or is a feature planned in the next
> release before I started hacking away at the code to
> implement this functionality myself.
> 
> Thanks.
> 
> Brian
> 
> __________________________________________________
> Do You Yahoo!?
> Yahoo! - Official partner of 2002 FIFA World Cup
> http://fifaworldcup.yahoo.com
> 
> _______________________________________________
> flow-tools@splintered.net
> http://www.splintered.net/sw/flow-tools