I have a pfsense server, all of attacks will come to its WAN interface. i have setup another packet analysis tool on private network behind pfsense. i want to send realtime WAN traffic from pfsense WAN to backend private server, which is listening on its ethernet interface for the packets to analyze them.
Is it possible to send traffic in realtime to backend server? so moloch (the tool) can analyze traffic in realtime?
Does anyone know how to clear out all the data in CA NFA ?
I'm currently testing out some sFlow monitoring but want to remove all the previously gathered data.
I tried rephrasing the question title about five times before arriving on this title.
Does nTop have the "built-in facilities" to process sFlow data so that a graph of source and destination of traffic can be revealed/processed in from the .rrd databases?
I have come across some other solutions, specifically nfdump/nfsen, but I can not find a clear answer to my question.
I'm currently opting to use sFlow over a port span/mirror only to see if it makes sense. I will be monitoring several slow links that will all range below 100Mbps.
I found the list here:
http://www.sflow.org/products/collectors.php
But was wondering if there are open source projects like Zenoss or others that can do SFlow collection and reporting for more than a 24 hour time period?
I did see that Zenoss has partnered with someone for a free one and will test that one out but wondered if there were any others out there that had some decent graphical views and maps and weren't impossible to setup.