I am trying to calculate the average bits-per-second bandwidth consumption
being represented by a set of flow records.
When I run the records selected by my filter through 'flow-stat -f0', an
average "Kbits / second" of about 96kbps results; when I use the same
filter in conjunction with flow-report, the avg_bps comes out to be more
like 26kbps.
Each application (ie flow-stat or flow-report) finds the filtered set of
flow records to contain 28527 flows, 179721109 Octets and 402943 Packets,
which tells me that the filter is being interpreted the same way by either
application.
I am wondering if flow-stat is telling me that the average bps being
consumed at any instant by _all_ matching flows is 96Kbps, while
flow-report is telling me that the average bps consumption by a flow in
the set is 26Kbps?
I would like to understand why the two numbers are so different, and how I
can achieve with flow-report what I have been getting from flow-stat.
-Chris Timmons, Network Engineer
Central Washington University
% flow-cat ft-v05.2005-03-31.2* | flow-nfilter -f ./e.nfi -F ffi \
| flow-stat -f0
Total Flows : 28527
Total Octets : 179721109
Total Packets : 402943
Total Time (1/1000 secs) (flows): 203128896
Duration of data (realtime) : 14399
Duration of data (1/1000 secs) : 14959457
Average flow time (1/1000 secs) : 7120.0000
Average packet size (octets) : 446.0000
Average flow size (octets) : 6300.0000
Average packets per flow : 14.0000
Average flows / second (flow) : 1.9070
Average flows / second (real) : 1.9812
Average Kbits / second (flow) : 96.1140
Average Kbits / second (real) : 99.8520
% flow-cat ft-v05.2005-03-31.2* \
| flow-report -s e.rpt -S e-traffic
# --- ---- ---- Report Information --- --- ---
# build-version: flow-tools 0.67
# name: e-traffic
# type: summary-counters
# options: +header,+totals
# fields: +avg-bps,+min-bps,+max-bps
# pre-filter: ffi
# records: 0
# first-flow: 1112328000 Thu Mar 31 20:00:00 2005
# last-flow: 1112342399 Thu Mar 31 23:59:59 2005
# now: 1112403915 Fri Apr 1 17:05:15 2005
# rec1:
ignores,flows,octets,packets,duration,avg_bps,min_bps,max_bps,avg_pps,min_pps,max_pps
0,28527,179721109,402943,203128896,26139.847278,9.200000,1028046.296296,14.505873,0.015563,518.261719
^^^^^^^^^^^^
a long way from 96K!!!
_______________________________________________
Flow-tools mailing list
[EMAIL PROTECTED]
http://mailman.splintered.net/mailman/listinfo/flow-tools
