hello,
I meet a problem when i use flow-stat and flow-report. The summary of octets percent exceed 100%. The command is:
flow-cat ft-v05.2005-07-08.180000+0800 | flow-stat -f11 -P -S2 | head -500
I use flow-stat with -P option to get octet percent of ipaddr, and the result is:
# IPaddr flows octets packets
#
202.107.217.*** 0.085 3.478 2.222
202.107.217.*** 0.084 2.786 1.867
202.107.217.*** 0.065 2.690 2.002
202.107.217.*** 0.085 2.641 1.749
202.107.217.*** 0.085 2.597 1.696
..............
Then I sum second field of total 500 record manually, the sumval = 127.27. I think this value must less than 100. When I stat UDP/TCP port(-f7), this problem appear again.
I do the experiment in flow-report, I get the same result.
# --- ---- ---- Report Information --- --- ---
# build-version: flow-tools 0.67
# name: IPAddr
# type: ip-address
# scale: 1
# options: +percent-total,+header,+xheader,+totals
# ip-src-addr-type: address
# ip-dst-addr-type: address
# sort_field: +octets
# fields: +key,+flows,+octets,+packets,+other
# records: 32
# first-flow: 731113371 Wed Mar 3 07:02:51 1993
# last-flow: 731113947 Wed Mar 3 07:12:27 1993
# now: 1120820136 Fri Jul 8 18:55:36 2005
#
# mode: streaming
# compress: off
# byte order: big
# stream version: 3
# export version: 5
#
# rec1: ignores,flows,octets,packets,duration
0,1157,118572,1376,318376
# recn: ip-address*,flows,octets,packets
192.168.0.155,91.097666,66.401849,76.744186
192.168.0.219,90.924806,66.071248,76.453488
192.168.0.255,8.729473,33.422730,23.110465
192.168.0.47,1.382887,13.254394,8.720930
octets percent of 192.168.0.155 is 66.4%, and octets percent of 192.168.0.219 is 66.07%. the sum of these records is much larger than 100%.
The config file is:
stat-report IPAddr
type ip-address
scale 1
ip-source-address-format address
ip-destination-address-format address
output
format ascii
sort +octets
fields +octets,+flows,+packets,-duration
options +header,+xheader,+totals,+percent-total
path /emv/netflow/tmp/IPAddr.1120813926988
stat-definition stat_def
report IPAddr
How to explain this problem?
thanks!
Javis Fang
ZOOM Networks
Nanjing Telecom. Software
Tel: 025-84820080 ext. 287
Fax: 025-84826660
E-mail:[EMAIL PROTECTED]
_______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
