[CentOS] What about port mirroring? (Was: Switch to measure traffic at IP level)

Neil Aggarwal wrote:
>> yeah, a 1gig port can't handle all the traffic from N 1gig 
>> ports.  heck, 
>> ti can't even handle all the traffic from a single full 
>> duplex connection
> 
> That is a good point.  My traffic is light right now
> so I might be able to use it until the traffic grows.

What kind of internet bandwidth do you have - that's going to be a limiting 
factor anyway.  I've had some trouble keeping ntop running for long intervals 
but there are ways to database collected results so you could restart it without 
losing data.  I'm not sure if it has a 95th percentile calculation, but it can 
summarize in a lot of other ways.

-- 
   Les Mikesell
    lesmikesell at gmail.com