We have a router that we need to monitor using NetFlow. The router is very important, so we are not allowed to enable Netflow on the router itself. Instead, it will have port mirroring enabled so that it can mirror traffic to another network device.
We have now two options:
a) Using software Netflow probe on a Linux server such as nProbe to convert the mirrored traffic into Netflow
b) Buy another router and enable Netflow on the other router to concert the mirrored traffic into Netflow.
We know that we can do (a)
The question is:
is it possible to do (b) ?
which is more effective (a) or (b)?