On 18/02/14 09:20, Dobbins, Roland wrote:
On Feb 18, 2014, at 2:15 PM, Aaron <[email protected]> wrote:
Usually nfsen seems to be pretty accurate, is there a reason for
that ~40 gbps reading during that ntp attack ?
Have you set your active flow timer to 60s/1m, so as to avoid
backlogged spikes?
AFAIK nfdump uses the start/end time in the flows to calculate pps, so
would this matter? Or is it a result of the sampling maths?
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
