3 Replies Latest reply on Jan 9, 2018 10:17 AM by jreves

    Feeding NTA from de-dupe-capable collector / Flow sampling




      I'm in the process of migrating 15 or so hospital-based Orion instances down into 4 consolidated regional instances. As part of that, I'm examining what we want to do with netflow. As many others have lamented in other threads, NTA does what it does ok but doesn't do extra stuff nor seem to have any intent of doing so (flow fan-out, de-dupe, etc). We are considering sending all flow to Riverbed first and leveraging it's de-dupe capabilities and then have it forward the flow onto NTA.  I'm curious if anyone else is doing this on large scale in practice and any lessons learned / projected caveats.


      I'm also curious to hear from folks that are doing flow sampling vs full tilt. Any regrets there ?