alex
Tue, 10 Jun 2008 03:00:13 -0700
Hello Ahmed,
I only want to add that you must be strong ensure that you compare
same flows of data. It is seem obviously but you can easy miss something
in setting of both programs and compare hasn't any sense.
Alex
> Hi Ahmed,
>
> On Tue, 10 Jun 2008, Ahmed Kamal wrote:
>
>> I have setup pmacct with your help, and it's been running like a champ. I
>> have also installed darkstat for comparison. I am seeing a big error
>>(around
>> 30%) between the 2 tools!
> ...
>> Here's what I am seeing:
>>
>> IP START END DELTA
>> DARKSTAT(bytes)
>> 81.10.100.42 7607.7053 9477.4200 1869.7147 1,397,584,555
>> 81.10.100.73 3603.2834 4716.6248 1113.3414 810,169,491
>> 81.10.100.37 3540.3343 5698.6758 2158.3415 1,573,900,631
>> 81.10.100.199 3444.3568 4358.3895 914.0327 575,124,842
>> 81.10.100.75 2951.8349 3697.5900 745.7551 556,560,149
>> 81.10.100.30 2770.9552 3807.6038 1036.6486 715,830,077
>> 81.10.100.46 2698.5764 3987.1379 1288.5615 856,582,079
>> 81.10.100.44 1982.1858 2381.7297 399.5439 296,992,631
>> 81.10.100.71 1880.2033 2522.7183 642.5150 548,180,038
>> 81.10.100.201 1300.2739 2040.0713 739.7974 411,031,858
>>
>> Those are the top 10 BW users. All measurements are in MB (from SQL
>>query),
>> darkstat data is in bytes. As you can see, the first line it's 1.9GB vs
>> 1.4GB and so on ...
>>
>> Any ideas how to track such errors ?
>
> My first suspicion would be that Darkstat is reporting bytes transferred
> (TCP data) rather than total size of packets. You can confirm this with
> some simple tests. E.g. create a file of exactly 1MB on a remote web
> server and download it through your pmacct/darkstat box. If darkstat
> reports that the amount downloaded is just over 1MB (e.g. 1.001 MB) then
> it's reporting TCP data.
>
> pmacct will always report packet sizes (IP data) and therefore is likely
> to report more bytes downloaded. Given that the TCP overhead is about 40
> bytes per 1500 byte packet, i.e. about 2.6%, I'd expect it to report about
> 1.027 MB in this case.
>
> The overhead will be much higher for smaller packets which may explain
> your observed 30% discrepancy. If so, this is arguably a bug (or
> limitation) of darkstat rather than pmacct.
>
> Please let us know what you discover.
>
> Cheers, Chris.
------
Недвижимость - по-прежнему самое перспективное вложение денег!
http://www.tmk.by Тел. (029) 628 28 28, (017) 507 61 37
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists