Igor Ybema
Wed, 13 Jan 2010 23:50:51 -0800
To conclude my findings regarding to this issue: Together with Paolo I discoverd that the HP switch which we are using does not correctly handle SFLOW resulting in bad values when using the sflow renormalize feature. In detail, we are using HP procurve 3500 switches. These switches (but also tested other HP switches, like the HP 2910) are sending wrong information in the sflow packets regarding to the sample-pool-size. The sample-pool-size is used (according to the RFC's) to calculate the real sample rate. However HP uses the total packet counter interface for the value for the sample-pool-size. This results in bad calculated sample rates because in some situations HP only sends ingress packets to sflow but still counts the total (ingress and egress packets), and the packet counter also counts packets which should not be counted for the sflow pool (like other ethernet frames, not being IP). So, I concluded, when you use HP procurve switches with sfacctd you can't use the sflow sfacctd_renormalize feature. This will result in bad values. Just use the "sql_preprocess: usrf=1024" feature where 1024 is the sample rate configured on you switch(es). _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists